topic Re: Custom calculated Field-Extraction in Splunk Search

Custom calculated Field-Extraction

meenal901 — Thu, 13 Dec 2012 11:11:16 GMT

Hi,

I have a data of the form:
Source,Date,Time
Source1,20120904,000000
Source3,20120904,000000
Source1,20120904,000000
Source4,20120904,000000
Source2,20120904,000000
Source3,20120904,000000
Source4,20120904,000000
Source2,20120904,000000

When i upload this file, i want to sort is based on column "Source" and add a custom column called "Unique_ID" which will have value of time+1 for same Source. Effectively, the data should look like:

Source,Date,Time
Source1,20120904,000001
Source1,20120904,000002
Source2,20120904,000001
Source2,20120904,000002
Source3,20120904,000001
Source3,20120904,000002
Source4,20120904,000001
Source4,20120904,000002

What regex should be written to props.conf and transforms.conf to do the same?

Re: Custom calculated Field-Extraction

martin_mueller — Thu, 13 Dec 2012 14:29:29 GMT

Regular expressions can neither sort nor count nor do maths. For that you need a more powerful language, such as a scripted input that does this work for you.

What's the ultimate goal you're trying to achieve here?

Re: Custom calculated Field-Extraction

meenal901 — Fri, 14 Dec 2012 12:05:13 GMT

Yes i understand the limitation of regex. The data is in a bucket of 15 minutes. I need a way to co-relate events of a source with another. A unique key at the time of adding data. But couldn't find.

Re: Custom calculated Field-Extraction

Ayn — Fri, 14 Dec 2012 12:43:17 GMT

You could use the _indextime field to check when events were indexed, and then use that (if I understood your scenario correctly).

Re: Custom calculated Field-Extraction

meenal901 — Tue, 11 Aug 2015 06:04:36 GMT

I resolved this by using eventstats at search time. Assigned a unique ID at run-time.