Splunk Search

extract field across sourcetypes

aniketb
Path Finder

Hi,

I have a regex to extract a field. I need unique count of those.
During exploring I found that the extracted field is limited to that sourcetype.
My query spans across 10-12 sourcetypes. Should I just keep adding the field to all sourcetypes?

PS: I'm just a Splunk user. I don't know where .conf files are, I don't have access.

0 Karma
1 Solution

lguinn2
Legend

If you don't have access to the .conf files, then yes - the only way to do this is to add the field to all the sourcetypes.

To speed things up, you can go to Manager » Fields » Field extractions and do this: open the field extraction that you need to copy. Using the copy/paste function of your browser, copy the Extraction/Transform from the first field, then create New field extractions and paste in the Extraction/Transform string.

This should be faster than running the Interactive Field Extractor multiple times. However, it won't work unless the field really is the same across all sourcetypes...

View solution in original post

0 Karma

rahulrawlani
Explorer

Hello

I even had a similar situation; and it seems to achieve it, below is something that works for me.

Assume if I have 2 sourcetypes namely st1, st2 from which I want to fetch the exact same field, I need to do the below

props.conf
[(?::){0}st*]
REPORT-st_combined = st_combined

transforms.conf
[st_combined]
REGEX = MyRegex

lguinn2
Legend

If you don't have access to the .conf files, then yes - the only way to do this is to add the field to all the sourcetypes.

To speed things up, you can go to Manager » Fields » Field extractions and do this: open the field extraction that you need to copy. Using the copy/paste function of your browser, copy the Extraction/Transform from the first field, then create New field extractions and paste in the Extraction/Transform string.

This should be faster than running the Interactive Field Extractor multiple times. However, it won't work unless the field really is the same across all sourcetypes...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...