Splunk Search

How to automatically remove extraneous characters from field value?

hcannon
Path Finder

Splunk is automatically (and correctly) extracting a user field/value in a particular set of logs, I'm looking for a way to setup an automatic field extraction (field transformation?) that will pull extraneous characters from the field value when they exist. I am trying to pull this data into the CIM for authentication, so need the data extracted automatically without the domain info.

Example - the following values are automatically being extracted as the field "user":
systemqa

systemprod
user-sync
userserviceacct
domain.local\jdoe
domain.local\bsmith
domain.local\mgarcia
domain.local\hjohnson

I need Splunk to automatically remove the string "domain.local\" from the user field in this log source- I know a few ways to do this within a search, but I'm lost as to how to do this automatically.

0 Karma
1 Solution

niketn
Legend

@hcannon, you are possibly looking for Calculated Fields Knowledge Object where eval commands can be saved. You can also achieve something similar if you use macro to place your custom logic for formatting data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

woodcock
Esteemed Legend

Take the RegEx that you are using in search to change this at search time and go to Settings -> Fields -> Field transformations -> New and create an automatic extraction with it.

0 Karma

niketn
Legend

@hcannon, you are possibly looking for Calculated Fields Knowledge Object where eval commands can be saved. You can also achieve something similar if you use macro to place your custom logic for formatting data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

hcannon
Path Finder

Yes, calculated fields were exactly what I was looking for - I hadn't used those before, so didn't realize that concept existed. I stuck the eval I was using as a find/replace in a new calculated field knowledge object and this did the trick. thanks!

0 Karma

niketn
Legend

@hcannon, I have converted my comment to answer. Please accept to mark this as answered 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...