topic Re: Field extration based on Event Type in Splunk Search

Field extration based on Event Type

resparis — Mon, 27 Jun 2022 15:14:57 GMT

Hi I have created a custom Event type and I would like to perform some field extraction based on the new event type, but I can't do it. I can only extract based on the Host, Source and sourcetype

Re: Field extration based on Event Type

martin_mueller — Wed, 31 Jul 2013 15:30:24 GMT

Yes, host source sourcetype only.

See http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf - specifically, the section explaining .

Re: Field extration based on Event Type

ykys97 — Mon, 28 Sep 2020 17:15:13 GMT

Eventtype produced under the conditions of a particular field >>

AS-IS

index=AAA (keyworld1 OR kewyorld2) AND (keyworld3)

To-BE

index=AAA (Specific_Field="keyworld1" OR Specific_Field="kewyorld2") AND (Specific_Field="keyworld3")

Re: Field extration based on Event Type

mathewboarman — Mon, 27 Jun 2022 15:03:08 GMT

Nine years on...

is it possible yet to define field extractions for particular eventtypes ?

Defining them on a sourcetype basis is too generic... one extraction does not fit all events for a given source type.

Example. - Linux file /var/log/secure contains Username in different places for successful login and for failed login... so two extractions are required for the same field "Username" Is this a reliable way to do it... ? Will the extractions conflict or will the results just be merged?