Splunk Operational Intelligence Cookbook - Third Edition

How to do it...

Follow these steps to add a custom field extraction for a response:

1. Log in to your Splunk server.
2. In the top right-hand corner, click on the Settings menu and then click on the Fields link.

3. Click on the Field extractions link:
   
4. Click on New.
5. In the Destination app field, select the search app, and in the Name field, enter response. Set the Apply to dropdown to sourcetype and the named field to access_combined. Set the Type dropdown to Inline, and for the Extraction/Transform field, carefully enter the (?i)^(?:[^"]*"){8}s+(?P<response>.+) regex:
6. Click on Save.
7. On the Field extractions listing page, find the recently added ...