Hello Splunkers, Please advise how to use regex to extract the below specific fields from _raw data and also add/rename the field name.The Index is a summary Index Sample Raw Data: "cutom_id":"n...
See more...
Hello Splunkers, Please advise how to use regex to extract the below specific fields from _raw data and also add/rename the field name.The Index is a summary Index Sample Raw Data: "cutom_id":"nuyc0989","group_na":"vc_iod","kit_num":"tach-98"
"cutom_id":"nuyc0989","group_na":"no_eng","kit_num":"vch-76"
"cutom_id":"nuyc0989","group_na":"vc_hk","kit_num":"tach-k89" I only want to extract {field:value} of "group_na" (rename field to assigned_to) & "kit_num" (rename field to Tax_ID) in the search results for all the _raw data of the summary index. Below search query is not extracting the required field from the raw data ,please advise Search Query - index=<summary_index> | rex field=_raw "\"group_na\": (?<assgined_to>*)"