Splunk Search
Highlighted

how to extract multiple values into one field

Path Finder

I have windows logs in below format, and not able to extract single field for merged text value.
I want to create a field named "Merged_text" from listed logs.

Sample:
Hostname = 1.1.1.1
Date time = 31.07/18 00:00:00
Merged text = user [abcd]: signed in on: signon pass on terminal '1.1.1.1' at 00:00:00 using 'Application name'.

Splunk extraction is not working, as Merged text got multiple strings.

0 Karma
Highlighted

Re: how to extract multiple values into one field

Legend

@utk123 I am confused. Which is data in your question and what you need to extract? Also what have you tried that did not work?




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: how to extract multiple values into one field

Motivator

Hi,

Below rex will create new field Merged_text and it captures until . (Full stop) After Application name.

Your base search
    | rex "Merged\stext\=(?<Merged_text>[^\.]+)"

View solution in original post

Highlighted

Re: how to extract multiple values into one field

New Member

Hi, I have a list of Tenants and the data is being pulled from Jira labels.

Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.

There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.

There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.

At the moment the view is :

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

I want it like :

Tenant Count
PLATFORM 29

0 Karma