https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279782#M32938 <P>Hello folks,</P> <P>I was wondering if you could help me with a dilemma about PERFORMANCE.</P> <P>I'm normalizing fields in order to use them with Splunk Common Information Model (CIM) and I don't know if using the extraction method like this:</P> <PRE><CODE>props.conf: [(?::){0}opsec*] REPORT-rule_as_rule_id = rule_as_rule_id transforms.conf: [rule_as_rule_id] REGEX = rule=(\w+) FORMAT = rule_id::$1 </CODE></PRE> <P>OR just use the FIELDALIAS like this:</P> <PRE><CODE>props.conf: [(?::){0}opsec*] FIELDALIAS-opsec_cim_fields = rule_id as rule_id </CODE></PRE> <P>Can you help me to understand what is the best method, if any?</P> <P>Thank you in advance!</P> Wed, 14 Dec 2016 14:18:14 GMT larmesto 2016-12-14T14:18:14Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279782#M32938 <P>Hello folks,</P> <P>I was wondering if you could help me with a dilemma about PERFORMANCE.</P> <P>I'm normalizing fields in order to use them with Splunk Common Information Model (CIM) and I don't know if using the extraction method like this:</P> <PRE><CODE>props.conf: [(?::){0}opsec*] REPORT-rule_as_rule_id = rule_as_rule_id transforms.conf: [rule_as_rule_id] REGEX = rule=(\w+) FORMAT = rule_id::$1 </CODE></PRE> <P>OR just use the FIELDALIAS like this:</P> <PRE><CODE>props.conf: [(?::){0}opsec*] FIELDALIAS-opsec_cim_fields = rule_id as rule_id </CODE></PRE> <P>Can you help me to understand what is the best method, if any?</P> <P>Thank you in advance!</P> Wed, 14 Dec 2016 14:18:14 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279782#M32938 larmesto 2016-12-14T14:18:14Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279783#M32939 <P>Field-aliases can be a bigger determent to performance. Martin_mueller (<A href="https://answers.splunk.com/users/134323/martin_mueller.html" target="_blank">https://answers.splunk.com/users/134323/martin_mueller.html</A>) could probably answer this better than I can with his fantastic .conf talk on the subject: <A href="http://conf.splunk.com/session/2015/conf2015_MMueller_Consist_Deploying_OptimizingSplunkKnowledge.pdf" target="_blank">http://conf.splunk.com/session/2015/conf2015_MMueller_Consist_Deploying_OptimizingSplunkKnowledge.pdf</A></P> <P>My take-away is - I wouldn't spend a whole lot of time fixing existing sourcetypes, but if you're doing it for a new sourcetype then i'd utilize a regex.</P> Tue, 29 Sep 2020 12:05:01 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279783#M32939 beatus 2020-09-29T12:05:01Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279784#M32940 <P>Thank you for your answer! I'll try this approach.</P> Wed, 14 Dec 2016 15:22:13 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-best-normalize-fields-for-Splunk-Common-Information-Model/m-p/279784#M32940 larmesto 2016-12-14T15:22:13Z