topic How does punct work? in Splunk Search

How does punct work?

cpeteman — Thu, 15 Aug 2013 21:51:18 GMT

NOTE: I figured that a lot of people will search "How does punct work?" and want to know. So if you were wondering: Punct info about half way down is a basic explanation.

ACTUAL QUESTION:This questions is not as easy as the title sounds. I know exactly WHAT punct does my question is where does it do it? I want to make a similar field but I cannot find the punct field extraction in manager->fields. Does anyone know how to look at this?

Re: How does punct work?

lukejadamec — Fri, 16 Aug 2013 00:17:17 GMT

Sounds like Splunk proprietary binary code to me.

Re: How does punct work?

lguinn2 — Fri, 16 Aug 2013 02:42:53 GMT

punct is called both an "internal" field and a "default" field. Like many other default fields, it is computed at parsing time and stored in the index. This is very different than search-time fields.

I agree with Luke; I think this is done in code as part of the parsing process. But perhaps a more knowledgeable person will chime in.

Documentation here: Use default fields

I couldn't find anything else.

Re: How does punct work?

cpeteman — Fri, 16 Aug 2013 17:11:51 GMT

Good enough for me I knew it was a default field but didn't think that it would make sense to be a binary. Coolio.

Re: How does punct work?

cpeteman — Fri, 16 Aug 2013 17:13:09 GMT

"didn't think that it would make sense to be a binary"
I meant that I didn't remember that it would make more sense that way. lol

Re: How does punct work?

saurabh_tek11 — Wed, 20 Dec 2017 09:38:57 GMT

@cpeteman @lukejadamec, To know more about punct you may refer to my answer here. Hope this will be of your help. Thank you - Saurabh