I'm new to parsing fields in splunk. And, in truth, I'm not great at regex yet. I'm trying to parse an event in Splunk like this.
[ EVENT_NUMBER = 4768 ]
That way my selected field is Event_Number and the value is 4768. I'm considering 2 options:
Any advice on the best course of action is appreciated.
TitanAE
Hi TitanAE,
try to use the Splunk Field Extractor that guides you in field extraction without knowing Regexes.
You can access it in an easy way:
Bye.
Giuseppe
P.S. I suggest to study regexes: when you'll know them you'll use only them (personal experience)!