Splunk Search

Extracting fields based on eventtype?

Super Champion

It is currently possible to setup field extractions based on an eventtype definition, but it sounds like this may not always be supported. I've been using this feature since Splunk 3.3 or 3.4 (when we first started using splunk). But based on some discussions with the engineers, it sounds like this feature may go away or be depreciated and it sounds like it's currently already a highly-discouraged feature.

I recently notice the following message in my info.csv in the job dispatch folder. (Seem's like it's a "DEBUG" message which is probably why I haven't seen it from the search UI)


Extracting fields based on eventtype is not supported during the main search. Please see splunk documentation for more information.

However I'm unable to find the related documentation. Anyone know the official answer to whether or not this feature is truly going away, and how soon? Would the message be more accurately stated: "searching for extracted fields based on eventtype is not supported during the main search"? Or is there some other meaning here?

I get that technically field extractions based on eventtypes is a complex and potentially confusing feature. I have many different types of events with unique field extractions for a single source/sourcetype; so I'm not sure what the recommendation is on how to replace my existing eventtype-based field extractions....


10 years later..... crickets


Hi Lowell,

Does this problem has been fixed in the latest version ?

I am interested in implementing a similar solution even-type based regex. Can you pls advise how you have implemented this ?


Kind Regards


0 Karma

Splunk Employee
Splunk Employee

We intend to leave the feature in in its "half-working" mode until we fix it or provide a better technique for extracting fields based on a dynamic condition. You are correct in saying that the message is more accurately stated as that you can't search for eventtype-extracted fields.


Stephen, are there any better techniques introduced in the recent versions? I have a similar problem where I have to define the eventtype before field extraction.


This is really neeeded, on shared plateform, the sourcetype is the same for everybody, and there are a lot of sources and host... so how to affect the extraction, if it is not possible to affect it to a source=key or an eventtype...

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...