topic Re: Splunk Field Extraction in Splunk Search

Splunk Field Extraction

cyber_castle — Wed, 30 Sep 2020 04:15:24 GMT

I have indexed few sample logs in to the Splunk..

2020-02-15T10:41:54.305Z servername.com sev="INFO" msg_details="Audit success" pol_name="policy_name"

Splunk by default extract the fields sev, msg_details, pol_name and extract the values appropriately. Everything loos good.

For me, i need to rename the field as severity instead of sev, Description instead of msg_details and Policies instead of pol_name.

I have updated the props.conf

[sourcetype] FIELDALIAS-severity = sev AS Severity FIELDALIAS-msg_details = msg_details AS Description FIELDALIAS-pol_name = pol_name AS Policies

Fields are extracting properly.

When i run the search on Verbose Mode, i can see both sev and Severity, which is quiet annoying for the Analysts

Is it normal or do i have to write a EXTRACT function with appropriate REGEX in order to show only the Severity field NOT sev.

gcusello — Thu, 20 Feb 2020 11:46:55 GMT

Hi @cyber_castle,
Yes it's normal:

if you create an alias you have both the fields,
also using a regex you continue to have all the automatic field extractions so you'll have both the field names.

the only way to avoid to have both the field names is to insert a rename in all your searches.

Ciao.
Giuseppe

cyber_castle — Thu, 20 Feb 2020 12:05:56 GMT

Thanks a lot for your prompt response.