topic Re: Extract fields in query or in config file in Splunk Search

Extract fields in query or in config file

indeed_2000 — Wed, 20 Dec 2023 16:59:52 GMT

What is the different between Extract fields in query with rex or in config file.

Pros and cons?

how about performance?

Thanks,

Re: Extract fields in query or in config file

gcusello — Wed, 20 Dec 2023 17:34:50 GMT

Hi @indeed_2000,

if you extract a field using the rex command you have this extraction only in the search,

if you have a field extraction (even if done with athe same regex) in conf file (that means save the regex as field extraction), you can use the field extractions in all searches (related to the permission of the knowledge object).

Ciao.

Giuseppe

Re: Extract fields in query or in config file

indeed_2000 — Wed, 20 Dec 2023 17:37:48 GMT

@gcusello How about performance?

Re: Extract fields in query or in config file

gcusello — Wed, 20 Dec 2023 17:40:22 GMT

Hi @indeed_2000 ,

exctly the same because the field exraction is performed at search time.

ciao.

Giuseppe

Re: Extract fields in query or in config file

isoutamo — Wed, 20 Dec 2023 19:48:36 GMT

it’s probably same, but (at least in there) if you have lot of those in conf files then those could minimally slow down the execution time as those conf files load every time when you are executed a query. But unless you haven’t thousands of those it probably don’t mark anything.

r. Ismo