topic Re: Apply field extraction to source field in Getting Data In

Apply field extraction to source field

namrithadeepak — Mon, 17 Jul 2017 15:22:32 GMT

Hi,

I need to extract a few fields from the 'source' field.

I do not have access to props.conf.

Is there anyway of doing this extraction from the Splunk Search Head UI? (as I do not have access to change props.conf)

Thanks,
Namritha

Re: Apply field extraction to source field

skoelpin — Mon, 17 Jul 2017 15:24:27 GMT

You can use rex but it will only apply at search time

Example:

... | rex field=source <REGEX>

Re: Apply field extraction to source field

namrithadeepak — Mon, 17 Jul 2017 15:32:11 GMT

I want to define it as an extracted field.

I am going to using field1 and field2 in summary indexes, and I do not want to include regex in summary index.

Re: Apply field extraction to source field

sbbadri — Mon, 17 Jul 2017 15:46:18 GMT

Fields » Field transformations » Add new
Name : tranfroms name
Type: regex-based
Regular expression: your regular
Format: your field name::$1
Source key: source

Fields » Field extractions » Add new

Name : extraction name
sourcetype : give your sourcetyp
Type: Use transform
Extraction/Transform: transform name mentioned above

I hope this helps

Re: Apply field extraction to source field

mattymo — Mon, 17 Jul 2017 15:49:55 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managesearch-timefieldextractions#Add_new_field_extractions_in_Splunk_Web

Badri nailed it. Here are the docs that walk you through it. This will be the same thing as configuring directly via the conf files.

Also remember that you don't need the field names in the capture groups if you use the transforms method.

Some real good reading here too:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Field_extraction_configuration
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#GLOBAL_SETTINGS

Re: Apply field extraction to source field

wpreston — Mon, 17 Jul 2017 15:58:03 GMT

If you go to Settings --> Fields --> Field Transformations, you can create a field transform (a field extracting regular expression) that uses the "source" field as the source-key.

Next go to Settings --> Fields --> Field Extractions and create a new extraction, being sure to set the "Type" to Transform and using the Transform you created above.

Be sure to put both of these in the correct app.

Re: Apply field extraction to source field

wpreston — Mon, 17 Jul 2017 15:59:21 GMT

@sbbadri beat me to it 🙂

Re: Apply field extraction to source field

namrithadeepak — Tue, 18 Jul 2017 21:10:14 GMT

Thankyou 🙂
Worked beautifully.

Re: Apply field extraction to source field

namrithadeepak — Tue, 18 Jul 2017 21:10:29 GMT

Thankyou very much