Splunk Search

Can I make a search time field extraction from a piece of the file/source?

brent_weaver
Builder

I need to create a field in splunk that is a portion of the file path, do I need to do that @ index time or can I do it at search time? I know the regex just dont know how to make a portion of source into a field in the event.

Thanks in advance!

0 Karma
1 Solution

Sukisen1981
Champion

you can see the source field to the left of the pane and below each event?
If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field

View solution in original post

0 Karma

Sukisen1981
Champion

you can see the source field to the left of the pane and below each event?
If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field

0 Karma

brent_weaver
Builder

How would I do the same in props.conf so it is perm setting?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee
0 Karma

Sukisen1981
Champion

you can. if your search regex is working fine you can do it at index time in props.conf.. check this out
https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html
However, one year ago I had done something similar and well, it hit me after 6 months when a different team working on the same source wanted to extract something else AND I had already disturbed that by editing the props.conf .... it is better to do this at search time , due to performance considerations as well as keeping future needs into account. However, the call is yours and the link above already answers this, you will have to use (almost) the same regex that you are using at search time.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...