Splunk Search

Field Extractions off host name

daniel333
Builder

Hello,

Our naming convention has a relatively strict set of rules on it.

e.g.
datacenter+envionmentnumber+securityzone+role+increment.
NY0099HTTPD001

Right now, I find myself add an extraction in EVERY source type I do to break that up as key value pairs for users. Is there a way to do this globally?

Tags (1)
0 Karma

Raghav2384
Motivator

Adding to what @acharlieh has mentioned, if you mention the extraction under default stanza, it should take precedence and apply to every sourcetype.
Example

The following stanza extracts an ip address from _raw

EXTRACT-extract_ip = (?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})
[foo]
.......

[bar]

Hope this helps. Thanks!
Raghav

0 Karma

acharlieh
Influencer

Not in the UI, but I would think you could define a named REPORT outside of all stanzas in props.conf, or define it in a wild carded stanza:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...