Best way to create a search time field extraction

[bowesmana]

I've spent a long time reading, but am not sure the best way to do this.

I have events, which contain

username-xxx, firstname, lastname, ...

I would like to extract the n digit username suffix 'xxx' to a new field called Company. Currently I'm doing this in my searches

rex field=Username ".-(?[a-z]$)" | eval Company=upper(Company)

(NB: For some reason Company has come out lower case above in this post, but it's upper case)

which works, but I want to avoid doing this each time and make it a permanent extraction. I am not sure of the right way

Calculated fields
Field extraction
Field transformation

What's the right way?

[Ayn · Accepted solution]

Field extraction, for instance using the Interactive Field Extractor. This will create permanent field extractions for you so you don't have to enter them manually inline in your search every time. http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX

[kristian_kolb]

Probably neater to do it like this (directly in props.conf):

EXTRACT-blah = -(?<company>[a-z]+) in Username

See the docs on props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

/K

[bowesmana]

OK, I made it work using props.conf and transforms.conf, with
REGEX = .-(?[a-z]$)
SOURCE_KEY = Username
in transforms.conf. It's not converted to uppercase, but I found out searching is not case sensitive, so that's OK.

[bowesmana]

Thanks, I already found some of your helpful posts... I tried that, but I only want the regex to work on the already found Username field rather than the complete event. Props.conf contains
EXTRACT-Company = (?i)^.*-(?P[^,]+),
and I also need Company to be uppercase.