Splunk Search

Dynamic defaults for index-time field extraction?

welchatquietple
Engager

I've a couple of index-time field extractions. In events that are missing one of these fields, is there a way to assign the most recently extracted value for that field from this source/sourcetype? The same behavior I see with timestamp inference, I'd like to be able to have for a non-default field extraction.

Tags (2)
0 Karma

woodcock
Esteemed Legend

Not really at index time but you can at search time like this:

| streamstats MyFieldAlways=last(MyField) | <your normal search stuff but use "MyFieldAlways" instead of "MyField">
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...