Splunk Search

Field extraction using Field Extractor

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I would extract a field as a part of source field and I know how to do this using rex command

| rex field=source "myregex"

but I'd like to configure this field once and not in all my searches.
I tried putting in field extractor

field=source "myregex"

but there's something wrong!

Anyone has any idea?

Bye.
Giuseppe

0 Karma
1 Solution

TStrauch
Communicator

Hi,

try this. You cannot use the "Field Extractor" for this. Need to Settings --> Fields --> Field extractions --> New

"myregex" in source

looks something like this then.

(?<newfield>.*) in source

regards

View solution in original post

0 Karma

TStrauch
Communicator

Hi,

try this. You cannot use the "Field Extractor" for this. Need to Settings --> Fields --> Field extractions --> New

"myregex" in source

looks something like this then.

(?<newfield>.*) in source

regards

0 Karma

gcusello
SplunkTrust
SplunkTrust

Perfect: without double quotes!
Thank you.
Bye.
Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The field extractor looks in the entire event. It's equivalent to rex field=_raw "myregex". You'll have to adjust your 'myregex' string to extract the desired field from the whole event.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

yes I know, but source field isn't in _row.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...