hello team,
I have data from CSV files coming into my Splunk instance, I can search and find that data.
However, they come together in the "Event" field, and I would like to separate them based on a comma to create dashboards for servers that haven't been patched in over 30 days and haven't been restarted in over 30 days. So I use the following search:
index="index_name" host=hostname source="path_to_file/file.csv" sourcetype="my_source"
And I get the results as follows:
How I see the event.
I'm new to using the tool so I'm a bit overwhelmed by the amount of information, so I'm not sure which way to go.
Is it possible to do this just using Splunk Commands? Note: As you can see I have hidden the real information about the servers, IPs and other names for compliance purposes.
... View more