field extraction

[N92]

Same sourcetype have two different patterns in that case how can I define field extractions? Because field extractions can work on the host, source or sourcetype only.

[Richfez · Accepted solution]

Field extractions only work when they work.

I know that sounds ... rather dumb, but it's actually the case that it's that simple.

For instance, two log lines (I'm winging it - there's no date/times in here, they're just examples):

Mary clicked button "apply changes"
Martin exited screen "payment options"

First, I'd notice that you could easily do an extraction that would cover both (name, action, action_target) or something like that.

But, if you had one extraction like
(?<name>\S+)\s+clicked button\s+"(?<target>[^"]*)
and another
(?<name>\S+)\s+exited screen\s+"(?<target>[^"]*)
the first would only apply to the first message and the second to the second, because they're achored with text in the middle so they'll only match when they match.

The problem MAY come in that the field Extractor (the web page field extraction builder in the Splunk UI) doesn't build good enough extractions to always make this work right, but we can help with that if we had sample data (probably in another question).

And even if they overlapped, that's OK. It generally just works fine though you may end up with multivalued values or other interesting things depending on exactly how the extractions were done.

Happy Splunking!
-Rich

[N92]

Can I put this regex directly in transform.conf?

If yes then what would be format and dest key. I gone through the documentation but not able to clearly understand. Would be great, If you share some overview for that values.

[jpolvino]

Can you please post a couple examples? If you want to do this on the fly (i.e., in a search), then the solution usually involves using a regular expression that uses group constructs along with "or" and quantifiers.

[N92]

I don't have handy that example. Will share soon. meanwhile could you give me reference for group constructs.