How to add data to an extracted field?

[Jason]

A client wishes to pull some data from one of their logs into a search-time-extracted field and prefix it with a bit of text.

However, I know that

[transformname]
REGEX = ...
FORMAT = fieldname::$1$2

doesn't work, nor does adding any other text into FORMAT. (It will come out as literally what you typed, not with the value of $1.) Looking at regex sites, it doesn't appear possible to get something into a capture group that doesn't actually exist in the event.

Is there any way to add knowledge by concatenation onto a search-time field with props/transforms, without use of the search commands (such as eval)? Concatenation of two extracted fields perhaps?

[gkanapathy · Accepted solution]

There is not, and if you did, it would not be possible to search for the field values (in current versions, 4.1.6 and down). Note a search like myfieldname=fvalue for a search-time field myfieldname is (by default) converted by Splunk into a search for (myfieldname=fvalue AND fvalue), i.e., Splunk will look for fvalue in the raw event text. The transformations you propose above would make this search fail.

You could do something like create an automatic scripted lookup if you like instead, though it must output to a different field name from the input.

[gkanapathy]

You could, but then searches over that field effectively turn into "grep", and don't use the search index to find the value.

[Jason]

Well you could add it to fields.conf with INDEXED_VALUE=false to stop the search term expansion.