Splunk Search

How to split the data dynamilly and further use it?

9198459056
Loves-to-Learn Everything

I have sample log in that count is there and in the same row in message are fix length log are there if same count so and count is also dynamic 

 

For eg

Date time server count server name

 

How can we get all the server count data

 

Labels (3)
0 Karma

martinpu
Communicator
| rex max_match=0 "(?<email>\S+\@\S+\.\S+)
| rex "\d+\/\d+\/\d+ (?<count>\d+)"
| table count email

 

 

0 Karma

9198459056
Loves-to-Learn Everything

Logs example

12/03/2022 2 sdf@gmail.xom adf@hotmail.com

13/3/2021 3 sdd@hotmail.com adf@gmqil.com sfgvc@orkut.com

It's like cout and email id will be varing every time 

So how to get that dynamically 

And further variable should be used to analyze  also

 

0 Karma
Get Updates on the Splunk Community!

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...