topic Re: field "punct" meaning in Splunk Search

field "punct" meaning

rashid47010 — Thu, 05 Jan 2017 20:11:04 GMT

Hi everyone,

I am seeing "punct" field against almost all indexes. what does that mean.

Re: field "punct" meaning

somesoni2 — Thu, 05 Jan 2017 20:52:47 GMT

See this

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Usedefaultfields#punct

Re: field "punct" meaning

niketn — Thu, 05 Jan 2017 21:04:59 GMT

@rashid47010... punct is default indexed fields which are patterns of punctuation within events. You can directly search for events belonging to to specific pattern.

Re: field "punct" meaning

paimonsoror — Thu, 05 Jan 2017 21:10:34 GMT

I find the field to be a great tool when I am trying to come up with a regex for field extractions. Sometimes you come up with a base search and no matter how hard you try to limit the results to a certain subset, there will always be some outliers. Punct is a fantastic way to quickly point you to the outliers that didn't match the pattern you expected. Huge help when building regex and accounting for variations of results in your base search.

Re: field "punct" meaning

jplumsdaine22 — Fri, 06 Jan 2017 13:41:56 GMT

Maybe someone from splunk can confirm but I believe technically it is _raw with all the spaces and tokens removed