https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300645#M90519 <P>By extraction you mean field extractions form access_combined_wcookie OR other indexed time parsing (line breaking/timestamp extractions etc)? </P> Tue, 29 Sep 2020 14:08:40 GMT somesoni2 2020-09-29T14:08:40Z https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300644#M90518 <P>Is there anyway to apply access_combined_wcookie extraction to some historical data during search time? Some of the data was not setup correctly as access_combined_wcookie source during index time, and we want to parse it for some quick reporting.</P> Tue, 29 Sep 2020 14:07:06 GMT https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300644#M90518 etam 2020-09-29T14:07:06Z https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300645#M90519 <P>By extraction you mean field extractions form access_combined_wcookie OR other indexed time parsing (line breaking/timestamp extractions etc)? </P> Tue, 29 Sep 2020 14:08:40 GMT https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300645#M90519 somesoni2 2020-09-29T14:08:40Z https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300646#M90520 <P>Yes. Field extractions. Is there an easier way to reparse these data using the access_combined_wcookie transformation?</P> Tue, 29 Sep 2020 14:07:20 GMT https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300646#M90520 etam 2020-09-29T14:07:20Z https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300647#M90521 <P>The simplest way is with by using <CODE>rename</CODE> on the old sourcetype so it pretends to be the new/fixed/correct sourcetype at search time:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Renamesourcetypes">https://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Renamesourcetypes</A></P> Fri, 19 May 2017 02:05:52 GMT https://community.splunk.com/t5/Splunk-Search/Re-apply-extraction-during-search-time-for-access-combined/m-p/300647#M90521 woodcock 2017-05-19T02:05:52Z