There are a few ways to onboard data into Splunk. Install a universal forwarder on the server to send log files to Splunk Have the server send syslog data to Splunk via a syslog server or Splunk Connect for Syslog Use the server's API to extract data for indexing Use Splunk DB Connect to pull data from the server's SQL database. Have the application send data directly to Splunk using HTTP Event Collector (HEC). ... View more

| rex "User Login to KTB Successful\s-\s[^\-]+\-\s(?<user>\S+)" ... View more

Hi,   Thank you so much! This worked ... View more

Yeh i have used the above stated documents to extract the data from splunk and its working fine. But i need to convert that data into string to use it at the front end part and no i can't use eval functions as i need to build a custom code. Kindly help me with that. ... View more

You are better off clicking Accept on this question and asking a new one. At this point, you and I are probably the only ones listening and you need a broader audience. ... View more

Great, glad I could help! Please accept the answer if this answered your question ... View more

You should think of the '|' as an operation delimiter. YOu have your base search : index=main airport="aus" This returns events in the index named main, with the key value pair airport that has the value "AUS". And nothing else. Now if you wanted to perform an operation on these search results, you need to '|' them to another function. Such as top. index=main | top limit=10 airport That will look in the index main, and return the top 10 values for the field airport. E.g. AUS=100, US=79, CHINA=40, etc. You should read through the Splunk documentation : http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Aboutsearchlanguagesyntax ... View more