topic Re: Best way to create a search time field extraction in Splunk Search

Best way to create a search time field extraction

bowesmana — Wed, 23 Oct 2013 06:32:27 GMT

I've spent a long time reading, but am not sure the best way to do this.

I have events, which contain

username-xxx, firstname, lastname, ...

I would like to extract the n digit username suffix 'xxx' to a new field called Company. Currently I'm doing this in my searches

rex field=Username ".-(?[a-z]$)" | eval Company=upper(Company)

(NB: For some reason Company has come out lower case above in this post, but it's upper case)

which works, but I want to avoid doing this each time and make it a permanent extraction. I am not sure of the right way

Calculated fields
Field extraction
Field transformation

What's the right way?

Re: Best way to create a search time field extraction

Ayn — Wed, 23 Oct 2013 06:52:35 GMT

Field extraction, for instance using the Interactive Field Extractor. This will create permanent field extractions for you so you don't have to enter them manually inline in your search every time. http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX

Re: Best way to create a search time field extraction

bowesmana — Wed, 23 Oct 2013 07:02:41 GMT

Thanks, I already found some of your helpful posts... I tried that, but I only want the regex to work on the already found Username field rather than the complete event. Props.conf contains
EXTRACT-Company = (?i)^.*-(?P[^,]+),
and I also need Company to be uppercase.

Re: Best way to create a search time field extraction

bowesmana — Wed, 23 Oct 2013 07:45:19 GMT

OK, I made it work using props.conf and transforms.conf, with
REGEX = .-(?[a-z]$)
SOURCE_KEY = Username
in transforms.conf. It's not converted to uppercase, but I found out searching is not case sensitive, so that's OK.

Re: Best way to create a search time field extraction

kristian_kolb — Wed, 23 Oct 2013 13:57:55 GMT

Probably neater to do it like this (directly in props.conf):

EXTRACT-blah = -(?<company>[a-z]+) in Username

See the docs on props.conf

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf