Alerting

Custom search for tabular view

chetansplunk
Engager

Hi Community,

Is there a way to get specific data from your log strings and put them in tabular format?

We have logs like activity xxxx failed for account yyyy and for user zzzz

So we need data xxxx, yyyy and zzzz as search data in tabular format for our alerts. Any help is appreciated..!

 

Thanking you in anticipation..!   

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

This is one of Splunk's basic features. You can pick fields/words/values from log events and then analysis / present those. For your above examples you can do it like:

| makeresults
| eval _raw="activity xxxx failed for account yyyy and for user zzzz"
``` above generate sample data, replace whit your base query ```
| rex "activity (?<activity>[^\s]+) failed for account (?<account>[^\s]+) and for user (?<user>[^s]+)"
| table activity account user

For more examples and trainings you should look e.g. https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchTutorial/WelcometotheSearchTutorial

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

This is one of Splunk's basic features. You can pick fields/words/values from log events and then analysis / present those. For your above examples you can do it like:

| makeresults
| eval _raw="activity xxxx failed for account yyyy and for user zzzz"
``` above generate sample data, replace whit your base query ```
| rex "activity (?<activity>[^\s]+) failed for account (?<account>[^\s]+) and for user (?<user>[^s]+)"
| table activity account user

For more examples and trainings you should look e.g. https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchTutorial/WelcometotheSearchTutorial

r. Ismo 

chetansplunk
Engager

Thank you so much.. It helped..

0 Karma

SinghK
Builder

Will need more info, what sourcetype you are using. As there may be a addon which can do field extractions needed here.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...