I've spent a long time reading, but am not sure the best way to do this.
I have events, which contain
username-xxx, firstname, lastname, ...
I would like to extract the n digit username suffix 'xxx' to a new field called Company. Currently I'm doing this in my searches
rex field=Username ".-(?
(NB: For some reason Company has come out lower case above in this post, but it's upper case)
which works, but I want to avoid doing this each time and make it a permanent extraction. I am not sure of the right way
Calculated fields
Field extraction
Field transformation
What's the right way?
Field extraction, for instance using the Interactive Field Extractor. This will create permanent field extractions for you so you don't have to enter them manually inline in your search every time. http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX
Field extraction, for instance using the Interactive Field Extractor. This will create permanent field extractions for you so you don't have to enter them manually inline in your search every time. http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX
Probably neater to do it like this (directly in props.conf):
EXTRACT-blah = -(?<company>[a-z]+) in Username
See the docs on props.conf
http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf
/K
OK, I made it work using props.conf and transforms.conf, with
REGEX = .-(?
SOURCE_KEY = Username
in transforms.conf. It's not converted to uppercase, but I found out searching is not case sensitive, so that's OK.
Thanks, I already found some of your helpful posts... I tried that, but I only want the regex to work on the already found Username field rather than the complete event. Props.conf contains
EXTRACT-Company = (?i)^.*-(?P
and I also need Company to be uppercase.