Splunk Enterprise Security

field extraction

N92
Path Finder

Same sourcetype have two different patterns in that case how can I define field extractions? Because field extractions can work on the host, source or sourcetype only.

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Field extractions only work when they work.

I know that sounds ... rather dumb, but it's actually the case that it's that simple.

For instance, two log lines (I'm winging it - there's no date/times in here, they're just examples):

Mary clicked button "apply changes"
Martin exited screen "payment options"

First, I'd notice that you could easily do an extraction that would cover both (name, action, action_target) or something like that.

But, if you had one extraction like
(?<name>\S+)\s+clicked button\s+"(?<target>[^"]*)
and another
(?<name>\S+)\s+exited screen\s+"(?<target>[^"]*)
the first would only apply to the first message and the second to the second, because they're achored with text in the middle so they'll only match when they match.

The problem MAY come in that the field Extractor (the web page field extraction builder in the Splunk UI) doesn't build good enough extractions to always make this work right, but we can help with that if we had sample data (probably in another question).

And even if they overlapped, that's OK. It generally just works fine though you may end up with multivalued values or other interesting things depending on exactly how the extractions were done.

Happy Splunking!
-Rich

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

Field extractions only work when they work.

I know that sounds ... rather dumb, but it's actually the case that it's that simple.

For instance, two log lines (I'm winging it - there's no date/times in here, they're just examples):

Mary clicked button "apply changes"
Martin exited screen "payment options"

First, I'd notice that you could easily do an extraction that would cover both (name, action, action_target) or something like that.

But, if you had one extraction like
(?<name>\S+)\s+clicked button\s+"(?<target>[^"]*)
and another
(?<name>\S+)\s+exited screen\s+"(?<target>[^"]*)
the first would only apply to the first message and the second to the second, because they're achored with text in the middle so they'll only match when they match.

The problem MAY come in that the field Extractor (the web page field extraction builder in the Splunk UI) doesn't build good enough extractions to always make this work right, but we can help with that if we had sample data (probably in another question).

And even if they overlapped, that's OK. It generally just works fine though you may end up with multivalued values or other interesting things depending on exactly how the extractions were done.

Happy Splunking!
-Rich

0 Karma

N92
Path Finder

Can I put this regex directly in transform.conf?

If yes then what would be format and dest key. I gone through the documentation but not able to clearly understand. Would be great, If you share some overview for that values.

0 Karma

jpolvino
Builder

Can you please post a couple examples? If you want to do this on the fly (i.e., in a search), then the solution usually involves using a regular expression that uses group constructs along with "or" and quantifiers.

0 Karma

N92
Path Finder

I don't have handy that example. Will share soon. meanwhile could you give me reference for group constructs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...