topic Extracting fields based on eventtype? in Splunk Search

Extracting fields based on eventtype?

Lowell — Wed, 08 Sep 2010 04:20:39 GMT

It is currently possible to setup field extractions based on an eventtype definition, but it sounds like this may not always be supported. I've been using this feature since Splunk 3.3 or 3.4 (when we first started using splunk). But based on some discussions with the engineers, it sounds like this feature may go away or be depreciated and it sounds like it's currently already a highly-discouraged feature.

I recently notice the following message in my info.csv in the job dispatch folder. (Seem's like it's a "DEBUG" message which is probably why I haven't seen it from the search UI)

Message:

Extracting fields based on eventtype is not supported during the main search. Please see splunk documentation for more information.

However I'm unable to find the related documentation. Anyone know the official answer to whether or not this feature is truly going away, and how soon? Would the message be more accurately stated: "searching for extracted fields based on eventtype is not supported during the main search"? Or is there some other meaning here?

I get that technically field extractions based on eventtypes is a complex and potentially confusing feature. I have many different types of events with unique field extractions for a single source/sourcetype; so I'm not sure what the recommendation is on how to replace my existing eventtype-based field extractions....

Re: Extracting fields based on eventtype?

Stephen_Sorkin — Wed, 08 Sep 2010 10:40:35 GMT

We intend to leave the feature in in its "half-working" mode until we fix it or provide a better technique for extracting fields based on a dynamic condition. You are correct in saying that the message is more accurately stated as that you can't search for eventtype-extracted fields.

Re: Extracting fields based on eventtype?

sbsbb — Tue, 30 Apr 2013 15:19:12 GMT

This is really neeeded, on shared plateform, the sourcetype is the same for everybody, and there are a lot of sources and host... so how to affect the extraction, if it is not possible to affect it to a source=key or an eventtype...

Re: Extracting fields based on eventtype?

KarunK — Mon, 26 Aug 2013 00:29:48 GMT

Hi Lowell,

Does this problem has been fixed in the latest version ?

I am interested in implementing a similar solution even-type based regex. Can you pls advise how you have implemented this ?

Thanks

Kind Regards

Re: Extracting fields based on eventtype?

ananthkumar12 — Mon, 29 Dec 2014 22:44:47 GMT

Stephen, are there any better techniques introduced in the recent versions? I have a similar problem where I have to define the eventtype before field extraction.
Thanks

Re: Extracting fields based on eventtype?

Eric_Mcknight — Thu, 17 Jan 2019 16:20:10 GMT

10 years later..... crickets