Splunk Search

How do I extract a value from the 'source' field at search-time?

Mick
Splunk Employee
Splunk Employee

My log directories are structured like so -

/var/myapplogs/<app-name>/logs/*.log

How can I extract <app-name> as a field name at search time?

gkanapathy
Splunk Employee
Splunk Employee

In search:

... | rex field=source "^/[^\/]/[^\/]/(?<app_name>[^\/])"

or in props.conf:

[mysourcetype]
EXTRACT-appname = ^/[^\/]/[^\/]/(?<app_name>[^\/]) in source

gkanapathy
Splunk Employee
Splunk Employee

No. Fields extracted from non-raw indexed fields won't search correctly unless you also configure the extracted field as INDEXED_VALUE = false in the fields.conf file.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

If you go with the props.conf approach, does this then make it possible to do searches on 'appname=fooapp' ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...