topic Re: Automatically extracting field at search time in Splunk Search

Automatically extracting field at search time

rahiparikh — Thu, 16 Jun 2011 17:52:05 GMT

Hi,

Previously I was searching and extracting field at search time by explicitly specifying rex command. Now, I want to do the same thing but I want splunk to understand that I want "that" field extracted when relevant data is searched. How can I do using manager? ( Also, I do wish to keep it general i.e. not based on any source or something similar. )

My previous query was -

* | rex "(?<authentication_type>(?i)(password))"

Now, I want to do something like this -

* authentication_type=password

Thanks, Rahil

Re: Automatically extracting field at search time

mw — Thu, 16 Jun 2011 21:21:09 GMT

Manager -> Fields -> Field Extractions

You can basically paste a rex regex into the new extraction. However, an extraction must target a source, sourcetype, or host. I suppose you could set the source value to "*" though.

Reading up on props.conf will give you some insight into this: http://www.splunk.com/base/Documentation/latest/admin/Propsconf

Re: Automatically extracting field at search time

rahiparikh — Mon, 20 Jun 2011 15:21:22 GMT

Thanks for the reply. I am unable to extract the field the way you specified using Manager.

Re: Automatically extracting field at search time

Ayn — Mon, 20 Jun 2011 21:24:22 GMT

Use the interactive field extractor.

http://www.splunk.com/base/Documentation/latest/User/InteractiveFieldExtractionExample

Re: Automatically extracting field at search time

rahiparikh — Mon, 20 Jun 2011 21:26:44 GMT

Hi,

I already tried that but in IFE it extracts some not required results. 😞

Though.. Thanks!

Re: Automatically extracting field at search time

Ayn — Mon, 20 Jun 2011 21:31:07 GMT

If the IFX creates an invalid extraction you can just specify your own regex that you know works.