I have a set of log data in Splunk Search app contained in source=sampledata,sourcetype=sample.
field1,field2,field3 are new fields that i added through the recievers REST endpoint
3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry
host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1
3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry
host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1
3/30/12
8:56:11.000 AM field1=Happy,field2=Sad,field3=Angry
host=myhost sourcetype=sample source=sampledata index=main timestamp=none splunk_server=L33604 punct==,=,= linecount=1
Lets say if i want to extract the fields: field1, field2 & field3 at search time, so i configured the say i am going to create new field exractions in $Splunk_HOME/users/admin/search/local/props.conf (props config file for search app)
What is the regex expression to extract each of these fields at search time(extracting the key value pairs during search time)? I thought it would be something like [\^$.|?*+()].
How to disable - extracting the fields based on key=value format in splunk, this is messing up my fields information, as i have defined columns in transform.conf file.
By default, Splunk will automatically extract the fields based on key=value format. the left of equal sign as field name and the right as its value.
As a parameter in the API call. Specifically, the rf
parameter. More info here: http://docs.splunk.com/Documentation/Splunk/latest/RESTAPI/RESTsearches#Tips_on_creating_searches
As in the search commands?
You need to specify the fields you want to be returned in your search request. Do that, and the fields you want will show up.
Yeah. When i want to retrieve the results from the search as an XML through search/jobs/{search_id}/results endpoint the i want the field xml tags to have the new field names i have created.
For example i want to see something like this when i retrieve.