How is priority handled for manual and automatic field extractions?

[pinVie]

HI,

how is priority handled in regards to extractions.

Lets assume I have an EXTRACT in props.conf extracting some field and calling it "user". E.g:

EXTRACT-uname = Username:(?<user>.*?)\s

Now in the same event I have a dynamic part e.g., a URL which somewhere/sometimes may contain "user=Peter".
So withing this event I'd have the field "user" twice - once extracted by my extraction, once automatically by Splunk (because it is a field value pair).

Which value will the field user have?

To mitigate this issue I currently switch off auto field extractions, but that's not how I like it to do.

Thx !

[jeffland · Accepted solution]

It will have both contents when you look at the field list (so one of them might already be present in 100% of the fields, but there can be further entries as well), but when you use the field in a command such as table you will get the one from your field extraction.

The field extraction is (usually) defined in the local space of either your user or the app, which is why it will have a higher precedence than the standard defined in the default.