Splunk Search

How can I extract specified fields from the log files uploaded in Splunk thru a UI?

tankhanandita
Explorer

I have created a UI which loads the user selected log file in Splunk. Now I have to extract some fields from that file and display that in a table format. How can I do it?
For the UI, I am using jsp and servlets.

0 Karma
1 Solution

woodcock
Esteemed Legend

Just run a search with something like this:

index=YourIndexHere | table YourFieldOne YourFieldTwo

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just run a search with something like this:

index=YourIndexHere | table YourFieldOne YourFieldTwo
0 Karma

tankhanandita
Explorer

Thank you so much for your help. I did the same thing. It was a careless mistake i was trying to wrong fields from the log files.
Again thank u very much.

0 Karma

tankhanandita
Explorer

I have another question.Kindly help on this one also
I have extracted certain feilds using java sdk from splunk with the table command. How can i view that data as a table in my java form.
or
The data extracted is in the form of job. How can i convert that data into string, so that i can apply conditional operators on that data.

Thanks in advance for your help.

0 Karma

woodcock
Esteemed Legend

You are better off clicking Accept on this question and asking a new one. At this point, you and I are probably the only ones listening and you need a broader audience.

0 Karma

tankhanandita
Explorer

But what if my index contains multiple files that have some common fields and i only want to retrieve the data from one file and not all the files?

0 Karma

woodcock
Esteemed Legend

This is basic stuff.

index=YourIndexHere source=MyOneSourceFileHere | table YourFieldOne YourFieldTwo
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...