How can I do this using Field Extraction in Splunk Cloud so that it automatically extracts this field at search time?

[shubhamsipah]

Hi,

I'm collecting logs from a s3 path using "Splunk Add-on for Amazon Web Services". I want to extract a field from the s3 path string. I was able to do it using this expression `rex field=source "[.]*\/batch_id=(?<batch_id>[0-9]*)\/[.]*"`.
How can I do this using Field Extraction in Splunk Cloud so that it automatically extracts this field at search time?

Thanks

[tshah-splunk]

Hey @shubhamsipah,

For the SplunkCloud environment, if you want to make any changes to the conf files, the best way would be to reach out to Splunk Support and they'll be able to make changes in your environment.

[shubhamsipah]

I was able to do this using Field extraction and transformation in Splunk web (Settings -> Field).
But as per my understanding, this field extraction will be done at search time, not index time.

[isoutamo]

Yes if you are adding those by GUI on SC then those are done on search time.

But you can do those own apps to do that same thing on search time. With apps you can mange those KO with Git and can keep better version control etc.

r. Ismo 

[isoutamo]

Another way is to create own app which you can vetted and then install as a self-service to Splunk Cloud.

r. Ismo