Splunk Search

How is priority handled for manual and automatic field extractions?

pinVie
Path Finder

HI,

how is priority handled in regards to extractions.

Lets assume I have an EXTRACT in props.conf extracting some field and calling it "user". E.g:

EXTRACT-uname = Username:(?<user>.*?)\s

Now in the same event I have a dynamic part e.g., a URL which somewhere/sometimes may contain "user=Peter".
So withing this event I'd have the field "user" twice - once extracted by my extraction, once automatically by Splunk (because it is a field value pair).

Which value will the field user have?

To mitigate this issue I currently switch off auto field extractions, but that's not how I like it to do.

Thx !

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

It will have both contents when you look at the field list (so one of them might already be present in 100% of the fields, but there can be further entries as well), but when you use the field in a command such as table you will get the one from your field extraction.

The field extraction is (usually) defined in the local space of either your user or the app, which is why it will have a higher precedence than the standard defined in the default.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

It will have both contents when you look at the field list (so one of them might already be present in 100% of the fields, but there can be further entries as well), but when you use the field in a command such as table you will get the one from your field extraction.

The field extraction is (usually) defined in the local space of either your user or the app, which is why it will have a higher precedence than the standard defined in the default.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...