Skip to main content

Return to Question

Corrected grammatical mistakes
Source Link
edit approved Nov 8, 2019 at 19:14
Usman Khan
edit approved Nov 8, 2019 at 19:14
Usman Khan
  • 3.9k
  • 6
  • 45
  • 91

I have data in splunksplunk like this:

DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 4/AHJGS/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/AJJ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/123/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/HJG/true/false

I want to get the this result from a splunksplunk query where name value is dynamic, I dont care about anything after that

like: Parameters name/city/isActive/: {regex here to get name value} and save that in new values to user further. Kindly guide me for this.

Thanks

I have data in splunk like this:

DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 4/AHJGS/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/AJJ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/123/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/HJG/true/false

I want to get the this result from a splunk query where name value is dynamic, I dont care about anything after that

like: Parameters name/city/isActive/: {regex here to get name value} and save that in new values to user further

I have data in splunk like this:

DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 4/AHJGS/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/AJJ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/123/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/HJG/true/false

I want to get the this result from a splunk query where name value is dynamic, I dont care about anything after that

like: Parameters name/city/isActive/: {regex here to get name value} and save that in new values to user further. Kindly guide me for this.

Thanks

Source Link
abhi
abhi
  • 2.1k
  • 7
  • 26
  • 27

Search string with dynamic value in Splunk

I have data in splunk like this:

DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 4/AHJGS/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/AJJ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/XYZ/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 6/123/true/false
DEBUG demp.find - [Local-Log] Parameters name/city/isActive/: 3/HJG/true/false

I want to get the this result from a splunk query where name value is dynamic, I dont care about anything after that

like: Parameters name/city/isActive/: {regex here to get name value} and save that in new values to user further