Answer by warren for splunk extraction from the log entries

Not sure how Python and Splunk are relating here – but this is just a matter of doing some field extractions.

Something like this should do it:

index=ndx sourcetype=srctp
| field field=_raw "PlatformVersion\W+(?<platform_version>[^\"]+)"
| rex field=_raw "PlatformClient\W+(?<platform_client>[^\"]+)"

from User warren – Stack Overflow https://stackoverflow.com/questions/71019040/splunk-extraction-from-the-log-entries/71036484#71036484
via IFTTT