Splunk Search

How to extract a field in my sample event log?

rileyken
Explorer

here is a small piece of an event in my log:

;GET.SVC.INFO 01-25-17 404<

it starts with a semi-colon and contains the text GET.SVC.INFO a space and then the data formatted as mm-dd-yy and then a space followed by the user id which in this case is 404 followed by an ampsersand lt and an ending semi-colon

I would like to extract the user id at index time as a field name myuserid

thanks

1 Solution

skoelpin
SplunkTrust
SplunkTrust

Assuming your userid is only word characters, this should work.

INFO\s\d+\-\d+\-\d+\s\d+\<(?<myuserid>\w+)

Assuming you need a CO and don't want to bump the service.. You should go to Extract New Fields on the left under Selected Fields, I'd prefer to write my own regular expression and enter in the regex above. Preview the extractions then save

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Assuming your userid is only word characters, this should work.

INFO\s\d+\-\d+\-\d+\s\d+\<(?<myuserid>\w+)

Assuming you need a CO and don't want to bump the service.. You should go to Extract New Fields on the left under Selected Fields, I'd prefer to write my own regular expression and enter in the regex above. Preview the extractions then save

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...