Splunk Search

Field Extractions off host name

daniel333
Builder

Hello,

Our naming convention has a relatively strict set of rules on it.

e.g.
datacenter+envionmentnumber+securityzone+role+increment.
NY0099HTTPD001

Right now, I find myself add an extraction in EVERY source type I do to break that up as key value pairs for users. Is there a way to do this globally?

Tags (1)
0 Karma

Raghav2384
Motivator

Adding to what @acharlieh has mentioned, if you mention the extraction under default stanza, it should take precedence and apply to every sourcetype.
Example

The following stanza extracts an ip address from _raw

EXTRACT-extract_ip = (?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})
[foo]
.......

[bar]

Hope this helps. Thanks!
Raghav

0 Karma

acharlieh
Influencer

Not in the UI, but I would think you could define a named REPORT outside of all stanzas in props.conf, or define it in a wild carded stanza:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...