medium10 pts · first answer countssiemkql
Pulling a value out with parse
Message holds text like "login ok user=meera src=10.1.2.3". What does this parse produce?
| parse Message with * "user=" User " src=" Src
Discussion 0
Join free to post in the discussion.
Related questions
- What stats count by does in SPLCybersecurity Analyst
- Grouping with summarize in KQLCybersecurity Analyst
- Why logs go to a SIEMCybersecurity Analyst
- Why normalise to a common schemaCybersecurity Analyst
- What a SIEM is forCybersecurity Analyst
- What a Splunk index isCybersecurity Analyst
- What sourcetype tells SplunkCybersecurity Analyst
- The Splunk Universal ForwarderCybersecurity Analyst