Getting Data In

How to do Field extraction in splunk without sourcetype?

smanojkumar
Communicator

Hi Splunkers!
   I need to extract the specific field which dosent consists of sourcetype in logs,

Is there is anything apart from Regex and Spath, i also welcomed, answers in different is needed.

Fields to extrcat - OS, OSRelease

smanojkumar_0-1692285716472.pngsmanojkumar_1-1692285780599.png


Thanks in Advance,

Manoj Kumar S

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| extract
0 Karma

smanojkumar
Communicator

Hi @ITWhisperer ,

   Thanks for your response!

    Can you please help with query as well to extract, also, if possible, please share regex code as well.

 

Thanks is  Advance!

Manoj Kumar S

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You said you didn't want regex or spath.

From the picture, which is not a good way to show your data by the way, it looks like it is reasonably structured with name/value pairs, which the extract command can extract into fields.

If this is not doing what you want, you should provide more information as to why it is not, and provide examples of your complete events (anonymised of course), but paste them into a codeblock </> so that we can use them to fabricate tests to resolve your issue.

Very few of us volunteers want to spend time trying to copy your example data from pictures.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...