Splunk Search

Re-apply extraction during search time for access_combined_wcookie data source

etam
New Member

Is there anyway to apply access_combined_wcookie extraction to some historical data during search time? Some of the data was not setup correctly as access_combined_wcookie source during index time, and we want to parse it for some quick reporting.

0 Karma

woodcock
Esteemed Legend

The simplest way is with by using rename on the old sourcetype so it pretends to be the new/fixed/correct sourcetype at search time:
https://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Renamesourcetypes

0 Karma

somesoni2
SplunkTrust
SplunkTrust

By extraction you mean field extractions form access_combined_wcookie OR other indexed time parsing (line breaking/timestamp extractions etc)?

0 Karma

etam
New Member

Yes. Field extractions. Is there an easier way to reparse these data using the access_combined_wcookie transformation?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...