topic Re: How to extract a field using regex at indexing time? in Splunk Search

How to extract a field using regex at indexing time?

kiran331 — Mon, 16 Oct 2017 17:31:39 GMT

Hi,

I'm ingesting the data in JSON format. we have a field event.user, which is auto extracted. is there a way to extract the new field user from event.user filed at indexing time?

for example:

event.user :
kiran331@SPl,
splunk@ADDS

I need to extract:

user:
kiran331
splunk

Re: How to extract a field using regex at indexing time?

ddrillic — Mon, 16 Oct 2017 23:06:40 GMT

The following is great - Create custom fields at index time

Re: How to extract a field using regex at indexing time?

kunalmao — Tue, 29 Sep 2020 16:19:11 GMT

props.conf at your indexer
[]
REGEX =
FORMAT = ::$1
WRITE_META = [true|false]
DEST_KEY =
DEFAULT_VALUE =
SOURCE_KEY =
REPEAT_MATCH = [true|false]
LOOKAHEAD =

and then bind it to transforms.conf at your indexer

[]
TRANSFORMS- =

for more details you can refer

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Configureindex-timefieldextraction

Re: How to extract a field using regex at indexing time?

kunalmao — Tue, 17 Oct 2017 07:43:43 GMT

it removed everything in brackets 😞

Re: How to extract a field using regex at indexing time?

mtulett_splunk — Tue, 21 Nov 2017 05:25:49 GMT

You should be able to edit your answer to update the text. When writing code, put four spaces before each line to convert the text into a code block - this prevents your text from being modified automatically.