Splunk Search

most frequent eventlogs challenge

kspoton
New Member

Here is the custom event log format:

field1 field2 field3 FREE_TEXT

How would one query, say Top 10, FREE_TEXT ignoring first 3 fields which are space separated. FREE_TEXT can be any application level debug message which is not a fixed format.

Creating Fields is not an option. Neither is the code change to generate standard log format like Apache web log.

Just a single instance Splunk server(no clustering).

Tags (2)
0 Karma

joebensimo
Path Finder

Why is creating fields not an option? Even if you don't want fields for all searches, you can create per-search fields using the rex command.

You should be able to do something like:

... | rex field=_raw "^[^ ]+ [^ ]+ [^ ]+ (?<free_text>.+)" | top limit=10 free_text
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...