Splunk Search

How to add data to an extracted field?

Jason
Motivator

A client wishes to pull some data from one of their logs into a search-time-extracted field and prefix it with a bit of text.

However, I know that

[transformname]
REGEX = ...
FORMAT = fieldname::$1$2

doesn't work, nor does adding any other text into FORMAT. (It will come out as literally what you typed, not with the value of $1.) Looking at regex sites, it doesn't appear possible to get something into a capture group that doesn't actually exist in the event.

Is there any way to add knowledge by concatenation onto a search-time field with props/transforms, without use of the search commands (such as eval)? Concatenation of two extracted fields perhaps?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is not, and if you did, it would not be possible to search for the field values (in current versions, 4.1.6 and down). Note a search like myfieldname=fvalue for a search-time field myfieldname is (by default) converted by Splunk into a search for (myfieldname=fvalue AND fvalue), i.e., Splunk will look for fvalue in the raw event text. The transformations you propose above would make this search fail.

You could do something like create an automatic scripted lookup if you like instead, though it must output to a different field name from the input.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is not, and if you did, it would not be possible to search for the field values (in current versions, 4.1.6 and down). Note a search like myfieldname=fvalue for a search-time field myfieldname is (by default) converted by Splunk into a search for (myfieldname=fvalue AND fvalue), i.e., Splunk will look for fvalue in the raw event text. The transformations you propose above would make this search fail.

You could do something like create an automatic scripted lookup if you like instead, though it must output to a different field name from the input.

gkanapathy
Splunk Employee
Splunk Employee

You could, but then searches over that field effectively turn into "grep", and don't use the search index to find the value.

0 Karma

Jason
Motivator

Well you could add it to fields.conf with INDEXED_VALUE=false to stop the search term expansion.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...