Hi,
we have client_id=tom. client_id=thomas, client_id=Jack, client_id=tom-new, client_id=tom_old.. so on like 100s of them. for a particular query such as
index=aaa sourcetype=bbb search "my string" | stats count by client_id
I want to extract value for the field "client_id", when I try to use the "extract field" in Splunk it is picking up different values which are not the actual client_id values.
how do I write regex/rex to entract "client_id"
query to look for the "client_id" filed and display its value.
You shouldn't need to use the field extractor for key=value fields as Splunk extracts them automatically.
Can you share some actual (sanitized) events?
Hi @mmengu416,
if in your logs you have client_id=tom
, Splunk recognize that client_id
is a field and associate tom
to this field, if otherwise you have a different format (e.g. client_id: tom
), you have to extract this field using regex
could you share an example of your logs?
Ciao.
Giuseppe