Category: Splunk

.* can be used in rex to extract all the contents/values/characters from the matching String. Syntax: Your__Base_Splunk_Query | rex field=field_name "Matching_String: (?<Custom_Field_Name>.*)" Example: Your__Base_Splunk_Query | rex field=info "ExtendedMessage: (?<ExceptionMessage>.*)" As per ....

substr() can be used to get last n characters from a field in Splunk. Syntax: | eval customfield=substr( Field, -15 ) Example: | eval recordId=substr( result, -15 )

streamstats can be used to display Row Number in Splunk table. streamstats in Splunk Query helps us to add cumulative summary statistics to all search results in a streaming manner. ....