Splunk Search

How to configure search-time fields

mburbidg
Explorer

I cannot find in the manual how to configure search-time field extraction. I would like to define some fields that apply across all sourcetype. I was told by a splunk trainer that you can't do that using the interactive field extraction tool but can do it in the configuration files.

Anyway I've search through the documentation and can't find either an example of description of how to do this.

0 Karma

southeringtonp
Motivator

Looks like you already figured out the first part, but just in case, here's a good reference:
     http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

If you want the extraction to apply to all sourcetypes, then just create your entry in props.conf at the top of the file, outside of any stanza heading. Entries in the file that are not beneath a [stanza] header are considered to be global.

There's no way to do a wildcard like [log4j-*], at least as of Splunk 4.1. There are three main options:

  1. Define the extraction globally, putting your EXTRACT-xxx or REPORT-xxx line at the top of props.conf.
  2. Define the extraction multiple times, with a separate stanza for each sourcetype
  3. Define the extraction for sourcetype [log4j], and rename each log4j-xxx sourcetype. Going forward, manually assign the sourcetype so that you don't get the variations.

Option 3 is usually preferable.

0 Karma

mburbidg
Explorer

I discovered that if the sourcetype is log4j-100, which is a single instances of a set of rolling logs then the field shows up in the field picker and works. Can't I wildcard the sourcetype?

0 Karma

mburbidg
Explorer

I found the documentation in the knowledge worker manual. I put the following in etc/system/local/props.conf

[log4j*]
EXTRACT-magazineTitle = (?i) magazineTitle:(?P.+?)\s+\w+:

The extractions shows up in the fields manager, but when I do searches it does not show up in the field picker. Is that normal?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...