Splunk Search

Can I make a search time field extraction from a piece of the file/source?

Builder

I need to create a field in splunk that is a portion of the file path, do I need to do that @ index time or can I do it at search time? I know the regex just dont know how to make a portion of source into a field in the event.

Thanks in advance!

0 Karma
1 Solution

Champion

you can see the source field to the left of the pane and below each event?
If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field

View solution in original post

0 Karma

Champion

you can see the source field to the left of the pane and below each event?
If yes then just try | rex field=source (your regex expression)....it will extract the regex from your source field

View solution in original post

0 Karma

Builder

How would I do the same in props.conf so it is perm setting?

0 Karma

Splunk Employee
Splunk Employee
0 Karma

Champion

you can. if your search regex is working fine you can do it at index time in props.conf.. check this out
https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html
However, one year ago I had done something similar and well, it hit me after 6 months when a different team working on the same source wanted to extract something else AND I had already disturbed that by editing the props.conf .... it is better to do this at search time , due to performance considerations as well as keeping future needs into account. However, the call is yours and the link above already answers this, you will have to use (almost) the same regex that you are using at search time.

0 Karma