Splunk Search

is there a way to escape source when log contains source field ?

charmsstyler
Explorer

Hey Splunk Experts,

I have a log that produce something like below; (Notice there is a key named source[not the splunk source])

timestamp source=graph name=standard
...

When I table the above log ; | table source name ; It shows source as in the log file path.

source              name
/opt/app/abc.log    standard

Is there a way to escape that so it shows value in log file - like below? Thank you!

source   name   
graph   standard
0 Karma
1 Solution

PavelP
Motivator

Hello @charmsstyler ,

try search time extraction

.... |rex "\s+source=(?<source_orig>[^\s]+)" | table source_orig name

View solution in original post

PavelP
Motivator

Hello @charmsstyler ,

try search time extraction

.... |rex "\s+source=(?<source_orig>[^\s]+)" | table source_orig name
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...