Splunk Search

How to add a field extraction to an existing default field?

CREVITCH
Path Finder

I have logs that do not use the default name value format for the user field. When I add a field extractor for my user format and name it "user", the default format of "user=" no longer is included in the search. How to I add to the existing field rule rather than replace it?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try adding a different field name instead of user for field extraction and then use a field alias to link both

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can do it like this :

props.conf:

[YourSourcetypeHere]
REPORT-SomeArbitraryUniqueStringHere = UserFieldMultipleFormats

transforms.conf:

[UserFieldMultipleFormats]
REGEX = (?:session (?:closed|opened) for|disconnected by|[Ii]nvalid|about|check pass;) user (\w+)
FORMAT = user::$1
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try adding a different field name instead of user for field extraction and then use a field alias to link both

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields

View solution in original post

0 Karma

CREVITCH
Path Finder

I have a number of formats for user. How can I create a field extractor that will cover all of them:

session closed for user XXXX
session opened for user XXXX
disconnected by user XXXX
invalid user XXXX
about user XXXX
check pass; user unknown
Invalid user XXXX
user=XXXX (default built into linux_secure)

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!