Here are some eventNames: 2022-NO_USER_IN_SESSION
, 1022-DRR_INFO
, ...
I need the values like: NO_USER_IN_SESSION
, 1022-DRR_INFO
(so eventName=NO_USER_IN_SESSION
)
How to split the eventNames (2022-NO_USER_IN_SESSION, 1022-DRR_INFO)
index=app sourcetype=Epc*Event splunk_server_group=ewe sourcetype=EpcPromotionsEvent eventName=?
use regular expression to do it .
Based on the fact that this is relatively simple regular expression, I will leave some links here to help you learn.
http://regexone.com/ - this is a great interactive tutorial
https://regex101.com/ - test out your regex ! example: https://regex101.com/r/eF7oF2/1
Splunk Regular Expressions - docs are great
Regular Expression Tutorial
What are the criteria for separating eventNames?