I have a set of logs which wasn't automatically parsed when indexed into Splunk.
I would like to extract a field from the logs, however the Interactive Field Extractor isn't picking up on the pattern. I would like to extract the second group of quotations after the phrase "SAML 2.0" (including the quotes) come up in the logs:
...."SAML 2.0" - - - "11.11.111.1111" "www.yahoo.com"
That's essentially how all of the logs look like. I was wondering how I could tell splunk to only extract the 2nd group of quotes after it sees SAML 2.0?
In transforms.conf add:
[stanzaname]
REGEX = .*"SAML 2.0".*\"(?.*)\".*
FORMAT = fieldname::"$1"
WRITE_META = true
props.conf
Add the following lines to props.conf:
[testlog]
TRANSFORMS-netscreen = stanzaname
fields.conf
Add the following lines to fields.conf:
[fieldname]
INDEXED=true
Restart Splunk for your configu
In transforms.conf add:
[stanzaname]
REGEX = .*"SAML 2.0".*\"(?.*)\".*
FORMAT = fieldname::"$1"
WRITE_META = true
props.conf
Add the following lines to props.conf:
[testlog]
TRANSFORMS-netscreen = stanzaname
fields.conf
Add the following lines to fields.conf:
[fieldname]
INDEXED=true
Restart Splunk for your configu