I have windows logs in below format, and not able to extract single field for merged text value.
I want to create a field named "Merged_text" from listed logs.
Hostname = 188.8.131.52
Date time = 31.07/18 00:00:00
Merged text = user [abcd]: signed in on: signon pass on terminal '184.108.40.206' at 00:00:00 using 'Application name'.
Splunk extraction is not working, as Merged text got multiple strings.
@utk123 I am confused. Which is data in your question and what you need to extract? Also what have you tried that did not work?
Below rex will create new field Merged_text and it captures until . (Full stop) After Application name.
Your base search | rex "Merged\stext\=(?<Merged_text>[^\.]+)"
Hi, I have a list of Tenants and the data is being pulled from Jira labels.
Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.
There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.
There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.
At the moment the view is :
I want it like :