Getting Data In

Is it possible to do search time field extraction based punct

fredclown
Builder

I have events in a log file and they have different formats from event to event. I'm wondering if there is any way to use the punct field to do conditional field extraction? Let's say I have these two punct formats ...

___::_---..__//:::__---_--_:______:____-___-__..._

___::_---..__//:::__---_--_:______:___...:_-__...:

 

Edit:

I'm specifically asking about doing it with props and transforms so that the fields are reusable.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

I think that you cannot do this with props and transforms. The reason for that is the order how those different processors are done in ingestion phase. See e.g https://www.aplura.com/assets/pdf/props_conf_order.pdf

Based on that diagram, ANNOTATE_PUNCT is after Splunk has apply other props and transforms stuff and events cannot go backwards on ingestion pipeline.

0 Karma

PrewinThomas
Motivator

@fredclown 

Yes. You can use it for conditional field extraction.

eg:

| makeresults count=2
| streamstats count as row
| eval _raw=case(
row=1, "abc::123-45..xy//:::zz-88-99:demo...end",
row=2, "abc:123-45..xy//:::zz-88-99:demo:from...:demo...:"
)
| eval punct=replace(_raw, "[A-Za-z0-9]", "_")
| eval type=case(
match(punct, "\\.\\.\\.___$"), "Type A",
match(punct, "\\.\\.\\.:$"), "Type B",
true(), "Unknown"
)
| table row _raw punct type

demo.JPG

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

0 Karma

fredclown
Builder

Thanks, and sorry I was not clear enough. I want to do this with props and transforms so that the fields are reusable.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

punct is (if it's generated, because its creation can be disabled) an indexed field like any other so you can use it. But the question is what do you mean by "conditional" extraction.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...