Splunk Search

Field extration based on Event Type

resparis
New Member

Hi I have created a custom Event type and I would like to perform some field extraction based on the new event type, but I can't do it. I can only extract based on the Host, Source and sourcetype

Labels (1)
Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Yes, host source sourcetype only.

See http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf - specifically, the section explaining .

View solution in original post

0 Karma

ykys97
Explorer

Eventtype produced under the conditions of a particular field >>

AS-IS

index=AAA (keyworld1 OR kewyorld2) AND (keyworld3)

To-BE

index=AAA (Specific_Field="keyworld1" OR Specific_Field="kewyorld2") AND (Specific_Field="keyworld3")

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yes, host source sourcetype only.

See http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf - specifically, the section explaining .

0 Karma

mathewboarman
Explorer

Nine years on...   

is it possible yet to define field extractions for particular eventtypes  ?

Defining them  on a sourcetype basis is too generic... one extraction does not fit all events for a given source type.

Example.  -    Linux file  /var/log/secure   contains Username in different places for successful login and for failed login...   so two extractions are required for the same field  "Username"   Is this a reliable way to do it... ?   Will the extractions conflict or will the results just be merged?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...