Splunk Search

Dynamic defaults for index-time field extraction?


I've a couple of index-time field extractions. In events that are missing one of these fields, is there a way to assign the most recently extracted value for that field from this source/sourcetype? The same behavior I see with timestamp inference, I'd like to be able to have for a non-default field extraction.

Tags (2)
0 Karma

Esteemed Legend

Not really at index time but you can at search time like this:

| streamstats MyFieldAlways=last(MyField) | <your normal search stuff but use "MyFieldAlways" instead of "MyField">
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.