Splunk Enterprise

Is it possible to extract a field across multiple indexes and multiple sourcetypes?

gordenkem
Observer

Is it possible to extract a field across multiple indexes and multiple sourcetypes?

Labels (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

@gordenkem  you need to elaborate a bit more, extractions can be done both at index and search-time.

the extractions are set at spec level with combination of props & transforms (optional in some cases).

the spec you could set is source, host, sourcetype... if you have them common across the said index, sourcetype yes it is otherwise you have to clone the config.

https://docs.splunk.com/Documentation/Splunk/9.0.1/Admin/Propsconf#GLOBAL_SETTINGS - Read <spec>

For example - I have index= a , index = b they both having a sourcetype = web:logs, if you set extraction to [web:logs] that applies to both indexes.

if both indexes having common sources [source::/log/webserver/logs/web.log], then setting extraction at source level apply to both indexes... you have to me mindful about source, sourcetype and host combo while setting. As long as the data follow same structure that should be fine otherwise you will end-up seeing inconsistent values in extracted fields.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...