<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Are Search-Time Fields Able To Be Overwritten in a transforms.conf File? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72544#M14799</link>
    <description>&lt;P&gt;I've not tested this, but a possible option may be a lookup table.  Say you have the whole name "Magic Johnson" extracted into a field called &lt;CODE&gt;player_name&lt;/CODE&gt; then you can define a lookup table similar to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;player_name,real_name
Magic Johnson,Earvin Johnson
Kareem Abdul-Jabbar, Lew Alcindor
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You can use this in your search similar to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| lookup player_name_lookup player_name output real_name AS player_name
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You will have to, of course, define &lt;CODE&gt;player_name_lookup&lt;/CODE&gt; in &lt;CODE&gt;transforms.conf&lt;/CODE&gt; similar to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[player_name_lookup]
filename=player_name_lookup.csv
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The part I'm not sure about is if &lt;CODE&gt;lookup&lt;/CODE&gt; will let you overwrite &lt;CODE&gt;player_name&lt;/CODE&gt; in the search results.  You may need to further post-process with &lt;CODE&gt;eval&lt;/CODE&gt;.&lt;/P&gt;</description>
    <pubDate>Thu, 16 Feb 2012 03:04:50 GMT</pubDate>
    <dc:creator>dwaddle</dc:creator>
    <dc:date>2012-02-16T03:04:50Z</dc:date>
    <item>
      <title>Are Search-Time Fields Able To Be Overwritten in a transforms.conf File?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72543#M14798</link>
      <description>&lt;P&gt;I was wondering if you can assign a search-time extracted field one value and then later, in a stanza that will be processed second, overwrite that field with a new value.  For example, I have a situation like this:&lt;/P&gt;

&lt;P&gt;Let's say I have 2 lines of text that reads:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Player Name: Earvin Johnson - Game 5: 10 Assists
Player Name: Magic Johnson - Game 6: 15 Assists
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;And I have these stanzas to generate Search-Time Field Extractions.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[stanza_name_foo]
REGEX = Name: (\w+) (\w+)
FORMAT = FIRST_NAME::$1 LAST_NAME::$2

[stanza_name_foo_nickname]
REGEX = Name: Magic
FORMAT = FIRST_NAME::Earvin
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So what I'm trying to do is assign the first name and last name of the player.  But if the first name just happens to be "Magic", I know that's actually Earvin Johnson, so I wanna change it.  In the case of the second sample line, the first stanza will extract the value of "Magic" for the field of &lt;CODE&gt;FIRST_NAME&lt;/CODE&gt;.  But in the second stanza, if I notice the word "Magic" is found after "Name: ", I wanna change the &lt;CODE&gt;FIRST_NAME&lt;/CODE&gt; field to "Earvin".&lt;/P&gt;

&lt;P&gt;Will this work?  Can I "overwrite" the Search-Time Extracted Field with the new value after it's already been defined once?  Or once it's defined, I can't change it?  Which means I'll have to do it backwards and run the second stanza first and the first stanza second.&lt;/P&gt;

&lt;P&gt;Thanks, guys.&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;James&lt;/LI&gt;
&lt;/UL&gt;</description>
      <pubDate>Thu, 16 Feb 2012 02:00:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72543#M14798</guid>
      <dc:creator>jchensor</dc:creator>
      <dc:date>2012-02-16T02:00:27Z</dc:date>
    </item>
    <item>
      <title>Re: Are Search-Time Fields Able To Be Overwritten in a transforms.conf File?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72544#M14799</link>
      <description>&lt;P&gt;I've not tested this, but a possible option may be a lookup table.  Say you have the whole name "Magic Johnson" extracted into a field called &lt;CODE&gt;player_name&lt;/CODE&gt; then you can define a lookup table similar to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;player_name,real_name
Magic Johnson,Earvin Johnson
Kareem Abdul-Jabbar, Lew Alcindor
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You can use this in your search similar to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| lookup player_name_lookup player_name output real_name AS player_name
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;You will have to, of course, define &lt;CODE&gt;player_name_lookup&lt;/CODE&gt; in &lt;CODE&gt;transforms.conf&lt;/CODE&gt; similar to:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[player_name_lookup]
filename=player_name_lookup.csv
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The part I'm not sure about is if &lt;CODE&gt;lookup&lt;/CODE&gt; will let you overwrite &lt;CODE&gt;player_name&lt;/CODE&gt; in the search results.  You may need to further post-process with &lt;CODE&gt;eval&lt;/CODE&gt;.&lt;/P&gt;</description>
      <pubDate>Thu, 16 Feb 2012 03:04:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72544#M14799</guid>
      <dc:creator>dwaddle</dc:creator>
      <dc:date>2012-02-16T03:04:50Z</dc:date>
    </item>
    <item>
      <title>Re: Are Search-Time Fields Able To Be Overwritten in a transforms.conf File?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72545#M14800</link>
      <description>&lt;P&gt;Hey, dwaddle!  Thanks for the suggestion, though to be honest I was looking for a way to accomplish this without needing to use a lookup file.  And I did test it out myself, actually, and I figured out the way it all behaves.  You can see my answer above.&lt;/P&gt;</description>
      <pubDate>Fri, 17 Feb 2012 03:27:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72545#M14800</guid>
      <dc:creator>jchensor</dc:creator>
      <dc:date>2012-02-17T03:27:08Z</dc:date>
    </item>
    <item>
      <title>Re: Are Search-Time Fields Able To Be Overwritten in a transforms.conf File?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72546#M14801</link>
      <description>&lt;P&gt;Also, I love the sample you gave, putting Kareem there.  ^_^  High Five!&lt;/P&gt;</description>
      <pubDate>Fri, 17 Feb 2012 03:30:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72546#M14801</guid>
      <dc:creator>jchensor</dc:creator>
      <dc:date>2012-02-17T03:30:32Z</dc:date>
    </item>
    <item>
      <title>Re: Are Search-Time Fields Able To Be Overwritten in a transforms.conf File?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72547#M14802</link>
      <description>&lt;P&gt;So apparently, the answer is no: you cannot overwrite a search-time extracted field after you've defined it already.  So basically, that just means I can accomplish what I want by doing things &lt;EM&gt;backwards&lt;/EM&gt;.  In other words, what I had above won't work.  But this will:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;[stanza_name_foo_01_magic]
REGEX = Name: Magic
FORMAT = FIRST_NAME::Earvin

[stanza_name_foo_99_main]
REGEX = Name: (\w+) (\w+)
FORMAT = FIRST_NAME::$1 LAST_NAME::$2
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The reason this works is that now, in ASCII order, "[stanza_name_foo_01_magic]" triggers first.  If it finds "Magic", it'll assign FIRST_NAME to Earvin.  Then, in the "[stanza_name_foo_99_main]" stanza, it'll read "Magic" and try to assign FIRST_NAME to Magic, but since it's already been assigned, it can't be overwritten.&lt;/P&gt;

&lt;P&gt;So I can do what I want, just in the reverse order I had it first listed here.&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;James&lt;/LI&gt;
&lt;/UL&gt;</description>
      <pubDate>Mon, 28 Sep 2020 11:24:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72547#M14802</guid>
      <dc:creator>jchensor</dc:creator>
      <dc:date>2020-09-28T11:24:55Z</dc:date>
    </item>
    <item>
      <title>Re: Are Search-Time Fields Able To Be Overwritten in a transforms.conf File?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72548#M14803</link>
      <description>&lt;P&gt;Of course, I could also use the "priority" field instead of naming the stanzas so that they execute alphabetically to make things easier with naming the stanzas.&lt;/P&gt;</description>
      <pubDate>Fri, 17 Feb 2012 03:32:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Are-Search-Time-Fields-Able-To-Be-Overwritten-in-a-transforms/m-p/72548#M14803</guid>
      <dc:creator>jchensor</dc:creator>
      <dc:date>2012-02-17T03:32:53Z</dc:date>
    </item>
  </channel>
</rss>

