topic Re: Static Fields in Splunk Search

Static Fields

tepus — Tue, 14 Apr 2020 15:16:03 GMT

Hi everyone,

I'm going through the course Splunk Fundamentals 2 and I'm sorry if the question is too easy: what does it mean for a field to be 'static'? Namely, in the slide 151 of Splunk 7.X Fundamentals Part 2 (IOD).pdf, it is stated:
'Use FX to extract fields that are static...'
But I couldn't find any definition of a 'static' field in the documentation. What does it mean?

Any help is appreciated!

Re: Static Fields

gcusello — Tue, 14 Apr 2020 15:28:11 GMT

Hi @tepus,
I don't know what they mean with "static", I can suppose that they would mean "stable" and available for searches, in other words, fields extracted with FX are available for others searches , instead if you extract a field using the rex command, field is useful only in that search.

ciao.
Giuseppe

Re: Static Fields

tepus — Tue, 14 Apr 2020 15:33:49 GMT

It makes sense to me. Thanks @gcusello !

Re: Static Fields

gcusello — Tue, 14 Apr 2020 15:40:05 GMT

Hi @tepus,
if this answer solves your problem, please accept and/or upvote it for the other members of Community.
Ciao and next time.
Giuseppe

Re: Static Fields

tepus — Tue, 14 Apr 2020 16:41:23 GMT

Hi again,

Here is a just-received answer from an official Splunk instructor from the Splunk Fundamentals 2 course:

In the context of field extraction, "static" means that the value of the field will not change in terms of the regex created to extract that field. After the regex is created, Splunk will extract only the results of that regex - any change will result in the regex not working, and produce an error.