Splunk Search

Best way to create a search time field extraction

bowesmana
SplunkTrust
SplunkTrust

I've spent a long time reading, but am not sure the best way to do this.

I have events, which contain

username-xxx, firstname, lastname, ...

I would like to extract the n digit username suffix 'xxx' to a new field called Company. Currently I'm doing this in my searches

rex field=Username ".-(?[a-z]$)" | eval Company=upper(Company)

(NB: For some reason Company has come out lower case above in this post, but it's upper case)

which works, but I want to avoid doing this each time and make it a permanent extraction. I am not sure of the right way

Calculated fields
Field extraction
Field transformation

What's the right way?

Tags (3)
0 Karma
1 Solution

Ayn
Legend

Field extraction, for instance using the Interactive Field Extractor. This will create permanent field extractions for you so you don't have to enter them manually inline in your search every time. http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX

View solution in original post

Ayn
Legend

Field extraction, for instance using the Interactive Field Extractor. This will create permanent field extractions for you so you don't have to enter them manually inline in your search every time. http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX

kristian_kolb
Ultra Champion

Probably neater to do it like this (directly in props.conf):

EXTRACT-blah = -(?<company>[a-z]+) in Username

See the docs on props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

/K

0 Karma

bowesmana
SplunkTrust
SplunkTrust

OK, I made it work using props.conf and transforms.conf, with
REGEX = .-(?[a-z]$)
SOURCE_KEY = Username
in transforms.conf. It's not converted to uppercase, but I found out searching is not case sensitive, so that's OK.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Thanks, I already found some of your helpful posts... I tried that, but I only want the regex to work on the already found Username field rather than the complete event. Props.conf contains
EXTRACT-Company = (?i)^.*-(?P[^,]+),
and I also need Company to be uppercase.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...