Knowledge Management

How do I calculate field in props.conf?



I have extracted a field username and it has domain and user

username= "google\\john"
username = "admin"

I need calculated to be created in props.conf where google should go to domain and john should go to user field

This domain field will be there only in certain logs

So whatever is there before "\\" should be considered as domain and after "\\" is user
In some cases domain wont be there, for those cases username to be tagged to user field

All this should happeb at backend props.conf

domain = google

user= john
user = googleuser
user = admin

Labels (2)
Tags (1)
0 Karma


Hi @VijaySrrie ,

you have to create another field extraction usig this regex

^((?<domain>\w+)\\\\)*(?<user>\w+) in user

that's the same thing to run the following command:

| rex field=user "^((?<domain>\w+)\\\\)*(?<user>\w+)"

you can test the regex at



Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...