topic Re: How to add a field extraction to an existing default field? in Splunk Search

How to add a field extraction to an existing default field?

CREVITCH — Fri, 18 Dec 2015 15:04:42 GMT

I have logs that do not use the default name value format for the user field. When I add a field extractor for my user format and name it "user", the default format of "user=" no longer is included in the search. How to I add to the existing field rule rather than replace it?

Re: How to add a field extraction to an existing default field?

CREVITCH — Fri, 18 Dec 2015 16:25:22 GMT

I have a number of formats for user. How can I create a field extractor that will cover all of them:

session closed for user XXXX
session opened for user XXXX
disconnected by user XXXX
invalid user XXXX
about user XXXX
check pass; user unknown
Invalid user XXXX
user=XXXX (default built into linux_secure)

Re: How to add a field extraction to an existing default field?

renjith_nair — Sat, 19 Dec 2015 12:58:33 GMT

Try adding a different field name instead of user for field extraction and then use a field alias to link both

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields

Re: How to add a field extraction to an existing default field?

woodcock — Mon, 21 Dec 2015 15:09:47 GMT

You can do it like this :

props.conf:

[YourSourcetypeHere]
REPORT-SomeArbitraryUniqueStringHere = UserFieldMultipleFormats

transforms.conf:

[UserFieldMultipleFormats]
REGEX = (?:session (?:closed|opened) for|disconnected by|[Ii]nvalid|about|check pass;) user (\w+)
FORMAT = user::$1