How to do One field extraction for similar sourcetypes?

[NoSpaces]

Hello to everyone.

After reading the post linked down below, I tried to use the same approach for sourcetypes from Windows hosts.

https://community.splunk.com/t5/Splunk-Search/Applying-Field-Extractions-to-Several-Sourcetypes/m-p/...

To do it I used this regex like a sourcetype:
(?::){0}*WinEventLog

But it didn't work, and I think that I misunderstood something.
Is anyone able to explain to me what was wrong?

[isoutamo · Accepted solution]

Hi

I think that your "regex" should be 

(?::){0}WinEventLog*

as the changing part is in the end of ST name.

r. Ismo 

[NoSpaces]

Thank you for your answer
I tried this one before posting the question, but it didn't work
Now, after I removed another extraction rules for each sourcetype, I decided to give it one more try
And now it's working as expected
I feel myself like dumm but happy 😃

[NoSpaces]

Up

[ITWhisperer]

What is your usecase (it could be that the other post does not apply for you)?

[NoSpaces]

All sourcetypes from Windows EventLog start with "WinEventLog".
For example:

• WinEventLog:Security
• WinEventLog:System
• WinEventLog:Application 
• WinEventLog:Microsoft-Windows-WindowsUpdateClient/Operational

It isn't necessary to use one extraction rule instead of per sourcetype because there aren't many different Windows sourcetypes in our production.
But I think that it's more convenient for me.

In my usecase I want to extract the Severity field, which I use for log coloring (global eventtype rule)
Below, you can see an example of a specific sourcetype:

[WinEventLog:Application]
EXTRACT-Severity = \sType=(?<Severity>\w+)