Hi all, if a log has the following types of log entries (INFO, ERROR, FATAL), how do I get splunk to recognise those entries as a field.
YC
Run a search that pulls only that source or sourcetype and use the field extractor. I prefer to use a source when specifying an automated field extraction.
I use the field extractor and call the field LogLevel.
Do post some representative sample events.