How to automatically remove extraneous characters from field value?

[hcannon]

Splunk is automatically (and correctly) extracting a user field/value in a particular set of logs, I'm looking for a way to setup an automatic field extraction (field transformation?) that will pull extraneous characters from the field value when they exist. I am trying to pull this data into the CIM for authentication, so need the data extracted automatically without the domain info.

Example - the following values are automatically being extracted as the field "user":
systemqa

systemprod
user-sync
userserviceacct
domain.local\jdoe
domain.local\bsmith
domain.local\mgarcia
domain.local\hjohnson

I need Splunk to automatically remove the string "domain.local\" from the user field in this log source- I know a few ways to do this within a search, but I'm lost as to how to do this automatically.

[woodcock]

Take the RegEx that you are using in search to change this at search time and go to Settings -> Fields -> Field transformations -> New and create an automatic extraction with it.

[niketn · Accepted solution]

@hcannon, you are possibly looking for Calculated Fields Knowledge Object where eval commands can be saved. You can also achieve something similar if you use macro to place your custom logic for formatting data.

[hcannon]

Yes, calculated fields were exactly what I was looking for - I hadn't used those before, so didn't realize that concept existed. I stuck the eval I was using as a find/replace in a new calculated field knowledge object and this did the trick. thanks!

[niketn]

@hcannon, I have converted my comment to answer. Please accept to mark this as answered 🙂