Splunk Search

extract field from splunk directory structure

spatil
Path Finder

Hi all,

I am bit new for splunk, and facing a problem to create a field using regular expression. This field values should be populated by reading splunk directory structure. for example , I have below folders in my splunk directory structure. \Splunk\etc\apps\appName\logs\myField1\ \Splunk\etc\apps\appName\logs\myField2\ \Splunk\etc\apps\appName\logs\myField3\ \Splunk\etc\apps\appName\logs\myField4\

My need is to create a field say "MyFields" which will be populated automatically with directory names under \Splunk\etc\apps\appName\logs\ . In this case myField1, myField2, myField3, myField4. I have a regular expression which can fetch directory names under path \Splunk\etc\apps\appName\logs. But I am struggling to add such field in splunk application. Any help will be appreciated.

regards, S

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi snehalapatil

there are two way to achieve that, index-time or search-time field extraction. about index-time extraction you can read more here http://www.splunk.com/base/Documentation/latest/Admin/Configureindex-timefieldextraction

but as many answers state, index-time field extraction is not the best to do:

In general, we recommend search-time extractions rather than index-time extractions. There are relatively few cases where index-time extractions are better, and they come at the cost of brittleness of configuration and an increase in index size (which in turn makes searches slower).

this means you better use search-time field extraction and here is a good source on that topic: http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

regards

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi snehalapatil

there are two way to achieve that, index-time or search-time field extraction. about index-time extraction you can read more here http://www.splunk.com/base/Documentation/latest/Admin/Configureindex-timefieldextraction

but as many answers state, index-time field extraction is not the best to do:

In general, we recommend search-time extractions rather than index-time extractions. There are relatively few cases where index-time extractions are better, and they come at the cost of brittleness of configuration and an increase in index size (which in turn makes searches slower).

this means you better use search-time field extraction and here is a good source on that topic: http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

regards

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...