Splunk Search

How to extract a field using regex at indexing time?

kiran331
Builder

Hi,

I'm ingesting the data in JSON format. we have a field event.user, which is auto extracted. is there a way to extract the new field user from event.user filed at indexing time?

for example:

event.user :
kiran331@SPl,
splunk@ADDS

I need to extract:

user:
kiran331
splunk

0 Karma

kunalmao
Communicator

props.conf at your indexer
[]
REGEX =
FORMAT = ::$1
WRITE_META = [true|false]
DEST_KEY =
DEFAULT_VALUE =
SOURCE_KEY =
REPEAT_MATCH = [true|false]
LOOKAHEAD =

and then bind it to transforms.conf at your indexer

[]
TRANSFORMS- =

for more details you can refer

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Configureindex-timefieldextraction

0 Karma

kunalmao
Communicator

it removed everything in brackets :disappointed_face:

0 Karma

mtulett_splunk
Splunk Employee
Splunk Employee

You should be able to edit your answer to update the text. When writing code, put four spaces before each line to convert the text into a code block - this prevents your text from being modified automatically.

0 Karma

ddrillic
Ultra Champion

The following is great - Create custom fields at index time

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...