I have windows logs in below format, and not able to extract single field for merged text value.
I want to create a field named "Merged_text" from listed logs.
Sample:
Hostname = 1.1.1.1
Date time = 31.07/18 00:00:00
Merged text = user [abcd]: signed in on: signon pass on terminal '1.1.1.1' at 00:00:00 using 'Application name'.
Splunk extraction is not working, as Merged text got multiple strings.
Hi,
Below rex will create new field Merged_text and it captures until . (Full stop) After Application name.
Your base search
| rex "Merged\stext\=(?<Merged_text>[^\.]+)"
Hi, I have a list of Tenants and the data is being pulled from Jira labels.
Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.
There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.
There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.
At the moment the view is :
Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15
I want it like :
Tenant Count
PLATFORM 29
Hi,
Below rex will create new field Merged_text and it captures until . (Full stop) After Application name.
Your base search
| rex "Merged\stext\=(?<Merged_text>[^\.]+)"
@utk123 I am confused. Which is data in your question and what you need to extract? Also what have you tried that did not work?