topic Re: What is difference between report and field extraction? in Splunk Search

What is difference between report and field extraction?

jangid — Mon, 23 Jul 2012 16:38:16 GMT

What is the difference between REPORT- and FIELD-?

Re: What is difference between report and field extraction?

sbrant_splunk — Mon, 23 Jul 2012 18:36:47 GMT

Are you referring to REPORT- and EXTRACT-? If so, the difference is that REPORT can reference one or more stanzas in transforms.conf while EXTRACT does not utilize transforms.conf (both are for search-time field extraction). It is explained in detail here, under the section "Field Extraction Configuration":

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Re: What is difference between report and field extraction?

jangid — Tue, 24 Jul 2012 09:09:31 GMT

Thanks for your reply.
I mean REPORT- and FIELD-

Re: What is difference between report and field extraction?

Drainy — Fri, 10 Aug 2012 10:15:24 GMT

If you're happy its been answered then all you need to do is click the tick next to the answer below to accept it 🙂 If you've answered it elsewhere, post it as your own answer and then you can accept that too. We keep closing questions for spam or duplicates

Re: What is difference between report and field extraction?

jangid — Fri, 10 Aug 2012 13:18:46 GMT

Thanks Drainy,
my question is still open and unanswered. I didn't get any answer so thought better to close it because there is no delete option.

Re: What is difference between report and field extraction?

Drainy — Fri, 10 Aug 2012 13:58:29 GMT

REPORT- is a search time extraction
FIELDALIAS- creates an alias for an existing field name, so if you already had a field such as ComputerName automatically extracted from windows event logs, you could create an alias to change it to comp_name for example.

Where have you seen FIELD- ? Its not documented.

Re: What is difference between report and field extraction?

Drainy — Fri, 10 Aug 2012 13:58:59 GMT

Ah, best bet is to just post a comment asking if anyone had any ideas to bump it back up the list 🙂

Re: What is difference between report and field extraction?

jangid — Mon, 13 Aug 2012 09:29:34 GMT

Thanks Drainy, I don't know exactly where I saw but I am sure it was either in Splunkbase or Answers.

Anyway Now after your reply there is no meaning of my question.

Thanks Drainy

Re: What is difference between report and field extraction?

Drainy — Mon, 13 Aug 2012 09:39:43 GMT

ah, I would assume it was a typo. If it did work it is probably just short-hand for FIELDALIAS much like Splunk doesn't care if you use TRANSFORM or TRANSFORMS