Splunk Enterprise Security

field extraction

N92
Path Finder

Same sourcetype have two different patterns in that case how can I define field extractions? Because field extractions can work on the host, source or sourcetype only.

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Field extractions only work when they work.

I know that sounds ... rather dumb, but it's actually the case that it's that simple.

For instance, two log lines (I'm winging it - there's no date/times in here, they're just examples):

Mary clicked button "apply changes"
Martin exited screen "payment options"

First, I'd notice that you could easily do an extraction that would cover both (name, action, action_target) or something like that.

But, if you had one extraction like
(?<name>\S+)\s+clicked button\s+"(?<target>[^"]*)
and another
(?<name>\S+)\s+exited screen\s+"(?<target>[^"]*)
the first would only apply to the first message and the second to the second, because they're achored with text in the middle so they'll only match when they match.

The problem MAY come in that the field Extractor (the web page field extraction builder in the Splunk UI) doesn't build good enough extractions to always make this work right, but we can help with that if we had sample data (probably in another question).

And even if they overlapped, that's OK. It generally just works fine though you may end up with multivalued values or other interesting things depending on exactly how the extractions were done.

Happy Splunking!
-Rich

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

Field extractions only work when they work.

I know that sounds ... rather dumb, but it's actually the case that it's that simple.

For instance, two log lines (I'm winging it - there's no date/times in here, they're just examples):

Mary clicked button "apply changes"
Martin exited screen "payment options"

First, I'd notice that you could easily do an extraction that would cover both (name, action, action_target) or something like that.

But, if you had one extraction like
(?<name>\S+)\s+clicked button\s+"(?<target>[^"]*)
and another
(?<name>\S+)\s+exited screen\s+"(?<target>[^"]*)
the first would only apply to the first message and the second to the second, because they're achored with text in the middle so they'll only match when they match.

The problem MAY come in that the field Extractor (the web page field extraction builder in the Splunk UI) doesn't build good enough extractions to always make this work right, but we can help with that if we had sample data (probably in another question).

And even if they overlapped, that's OK. It generally just works fine though you may end up with multivalued values or other interesting things depending on exactly how the extractions were done.

Happy Splunking!
-Rich

0 Karma

N92
Path Finder

Can I put this regex directly in transform.conf?

If yes then what would be format and dest key. I gone through the documentation but not able to clearly understand. Would be great, If you share some overview for that values.

0 Karma

jpolvino
Builder

Can you please post a couple examples? If you want to do this on the fly (i.e., in a search), then the solution usually involves using a regular expression that uses group constructs along with "or" and quantifiers.

0 Karma

N92
Path Finder

I don't have handy that example. Will share soon. meanwhile could you give me reference for group constructs.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...