Splunk Search

Automatically extracting field at search time

rahiparikh
Explorer

Hi,

Previously I was searching and extracting field at search time by explicitly specifying rex command. Now, I want to do the same thing but I want splunk to understand that I want "that" field extracted when relevant data is searched. How can I do using manager? ( Also, I do wish to keep it general i.e. not based on any source or something similar. )

My previous query was -

* | rex "(?<authentication_type>(?i)(password))"

Now, I want to do something like this -

* authentication_type=password

Thanks,
Rahil

0 Karma

Ayn
Legend
0 Karma

Ayn
Legend

If the IFX creates an invalid extraction you can just specify your own regex that you know works.

0 Karma

rahiparikh
Explorer

Hi,

I already tried that but in IFE it extracts some not required results. 😞

Though.. Thanks!

0 Karma

mw
Splunk Employee
Splunk Employee

Manager -> Fields -> Field Extractions

You can basically paste a rex regex into the new extraction. However, an extraction must target a source, sourcetype, or host. I suppose you could set the source value to "*" though.

Reading up on props.conf will give you some insight into this: http://www.splunk.com/base/Documentation/latest/admin/Propsconf

0 Karma

rahiparikh
Explorer

Hi

Thanks for the reply. I am unable to extract the field the way you specified using Manager.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...