Splunk Dev

unstructured logs how to extract the given item example

mindia
New Member

The unsturctured log contains many lines and at the end below coverage report, it is not getting captured as a field, even Extract new field, when I tried, it is adding junk data in the fields covering other lines

line1
line2
..
...
line n
============ coverage report ==========
Statements : 34% (20/22)

Lines : 56% (56/100)

Is it possible to create a search query which would generate the table like

_time Statements Lines
14-9-2018 34% 56%

Since the coverage report is unstructured not able to capture the details as a field.... any suggestions are welcome.

Thanks!.

Tags (1)
0 Karma

493669
Super Champion

Hi @mindia,
you can try this on raw data :

...|rex "Statements : (?<Statements>[^\s+]+).*Lines : (?<Lines>[^\s+]+)"|table _time, Statements , Lines
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...