A client wishes to pull some data from one of their logs into a search-time-extracted field and prefix it with a bit of text.
However, I know that
[transformname] REGEX = ... FORMAT = fieldname::$1$2
doesn't work, nor does adding any other text into FORMAT. (It will come out as literally what you typed, not with the value of $1.) Looking at regex sites, it doesn't appear possible to get something into a capture group that doesn't actually exist in the event.
Is there any way to add knowledge by concatenation onto a search-time field with props/transforms, without use of the search commands (such as eval)? Concatenation of two extracted fields perhaps?
There is not, and if you did, it would not be possible to search for the field values (in current versions, 4.1.6 and down). Note a search like
myfieldname=fvalue for a search-time field
myfieldname is (by default) converted by Splunk into a search for
(myfieldname=fvalue AND fvalue), i.e., Splunk will look for
fvalue in the raw event text. The transformations you propose above would make this search fail.
You could do something like create an automatic scripted lookup if you like instead, though it must output to a different field name from the input.
You could, but then searches over that field effectively turn into "grep", and don't use the search index to find the value.