Archive
Highlighted

field "punct" meaning

Communicator

Hi everyone,

I am seeing "punct" field against almost all indexes. what does that mean.

Tags (2)
0 Karma
Highlighted

Re: field "punct" meaning

SplunkTrust
SplunkTrust
Highlighted

Re: field "punct" meaning

Legend

@rashid47010... punct is default indexed fields which are patterns of punctuation within events. You can directly search for events belonging to to specific pattern.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: field "punct" meaning

Influencer

Maybe someone from splunk can confirm but I believe technically it is _raw with all the spaces and tokens removed

0 Karma
Highlighted

Re: field "punct" meaning

Builder

I find the field to be a great tool when I am trying to come up with a regex for field extractions. Sometimes you come up with a base search and no matter how hard you try to limit the results to a certain subset, there will always be some outliers. Punct is a fantastic way to quickly point you to the outliers that didn't match the pattern you expected. Huge help when building regex and accounting for variations of results in your base search.