Splunk Search

Searching logfile unrecognised key value pairs

smudge797
Path Finder

Whats the best way to search on the fields within a log that are not automatically recognised as key value pair?

So if i wanted to search on UniqueRequestGUID & XPID values (and display results in a table) below:

2014-06-26T04:56:31.105-07:00 - INFO
RequestType:SFPRe
UniqueRequestGUID:c17d9d1e-9cf8-4866-a166-bc5b4c96374a
ProductType:0
XPID:1
EPID:0
ProductCode:
YGDB_Conn:0
YGDB_RequestDuration:9
Payment:false

Tags (3)
0 Karma

somesoni2
Revered Legend

Try this

props.conf

[YourSourceType]
REPORT-requestfields = transform_requests

transforms.conf

[transform_requests]
DELIMS = "\n", ":"
CLEAN_KEYS = true
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...