Extracting fields based on eventtype?

[Lowell]

It is currently possible to setup field extractions based on an eventtype definition, but it sounds like this may not always be supported. I've been using this feature since Splunk 3.3 or 3.4 (when we first started using splunk). But based on some discussions with the engineers, it sounds like this feature may go away or be depreciated and it sounds like it's currently already a highly-discouraged feature.

I recently notice the following message in my info.csv in the job dispatch folder. (Seem's like it's a "DEBUG" message which is probably why I haven't seen it from the search UI)

Message:

Extracting fields based on eventtype is not supported during the main search. Please see splunk documentation for more information.

However I'm unable to find the related documentation. Anyone know the official answer to whether or not this feature is truly going away, and how soon? Would the message be more accurately stated: "searching for extracted fields based on eventtype is not supported during the main search"? Or is there some other meaning here?

---

I get that technically field extractions based on eventtypes is a complex and potentially confusing feature. I have many different types of events with unique field extractions for a single source/sourcetype; so I'm not sure what the recommendation is on how to replace my existing eventtype-based field extractions....

[Eric_Mcknight]

10 years later..... crickets

[KarunK]

Hi Lowell,

Does this problem has been fixed in the latest version ?

I am interested in implementing a similar solution even-type based regex. Can you pls advise how you have implemented this ?

Thanks

Kind Regards

KK

[Stephen_Sorkin]

We intend to leave the feature in in its "half-working" mode until we fix it or provide a better technique for extracting fields based on a dynamic condition. You are correct in saying that the message is more accurately stated as that you can't search for eventtype-extracted fields.

[ananthkumar12]

Stephen, are there any better techniques introduced in the recent versions? I have a similar problem where I have to define the eventtype before field extraction.
Thanks

[sbsbb]

This is really neeeded, on shared plateform, the sourcetype is the same for everybody, and there are a lot of sources and host... so how to affect the extraction, if it is not possible to affect it to a source=key or an eventtype...