topic Re: Is it possible to namespace fields to a specific index? in Knowledge Management

Is it possible to namespace fields to a specific index?

tragiccode — Tue, 06 Dec 2016 15:11:14 GMT

I am new to Splunk but i have a search query that queries more than 1 index and each index has unique fields on it. Is there a way to easily namespace the fields to a specific index in my search to readers can easily see that the Error field belongs to the windows eventlog index and the level field belongs to the log4net index?

index="log4net" OR index="wineventlog" AND Type="Error" OR level="Error" earliest=-1h latest=now

Right now the reader of the search has no way to know which field exists in what index.

Re: Is it possible to namespace fields to a specific index?

adamsaul — Tue, 06 Dec 2016 16:29:20 GMT

Morning tragiccode,

The default fields for each event that are returned in a search are as follows:
host, index, linecount, punct, source, sourcetype, splunk_server, timestamp
and the default selected fields are:
host, source, sourcetype

index is included as a default but not selected.

Therefore, do you have a specific output you were looking for?

Re: Is it possible to namespace fields to a specific index?

tragiccode — Tue, 06 Dec 2016 17:38:08 GMT

Sorry i think i stated the question incorrectly.

In the above search i'm searching 2 different indexes. One index called log4net contains a field called level. The other index is called wineventlog and contains a field called Type. The problem in the search, for anyone reading it, they have no idea that field type belongs only to the windows event log and field level belongs only to log4net. Is there anyway to make the search more implicit on which index these fields come from in the above search? example can you do something like this

 index="log4net" OR index="wineventlog" AND wineventlog:Type="Error" OR log4net:level="Error" earliest=-1h latest=now

Re: Is it possible to namespace fields to a specific index?

adamsaul — Tue, 06 Dec 2016 17:48:54 GMT

tragiccode,

I do not know of a way to do what your example is asking but you can quickly help the user understand which index they come from by how you present the results.

Example, appending a table command to the end of your existing search:
index="log4net" OR index="wineventlog" AND wineventlog:Type="Error" OR log4net:level="Error" earliest=-1h latest=now | table host source sourcetype index _raw