https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342578#M101476 <P>How would I do the same in props.conf so it is perm setting?</P> Tue, 19 Sep 2017 16:25:10 GMT brent_weaver 2017-09-19T16:25:10Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342576#M101474 <P>I need to create a field in splunk that is a portion of the file path, do I need to do that @ index time or can I do it at search time? I know the regex just dont know how to make a portion of source into a field in the event.</P> <P>Thanks in advance!</P> Tue, 19 Sep 2017 16:13:33 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342576#M101474 brent_weaver 2017-09-19T16:13:33Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342577#M101475 <P>you can see the source field to the left of the pane and below each event?<BR /> If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field</P> Tue, 19 Sep 2017 16:17:20 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342577#M101475 Sukisen1981 2017-09-19T16:17:20Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342578#M101476 <P>How would I do the same in props.conf so it is perm setting?</P> Tue, 19 Sep 2017 16:25:10 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342578#M101476 brent_weaver 2017-09-19T16:25:10Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342579#M101477 <P>you can. if your search regex is working fine you can do it at index time in props.conf.. check this out<BR /> <A href="https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html">https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html</A><BR /> However, one year ago I had done something similar and well, it hit me after 6 months when a different team working on the same source wanted to extract something else AND I had already disturbed that by editing the props.conf .... it is better to do this at search time , due to performance considerations as well as keeping future needs into account. However, the call is yours and the link above already answers this, you will have to use (almost) the same regex that you are using at search time.</P> Tue, 19 Sep 2017 16:38:32 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342579#M101477 Sukisen1981 2017-09-19T16:38:32Z https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342580#M101478 <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">Configuring your field extractions in props.conf</A> (click me!).</P> Tue, 19 Sep 2017 16:47:32 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-make-a-search-time-field-extraction-from-a-piece-of-the/m-p/342580#M101478 s2_splunk 2017-09-19T16:47:32Z