Splunk Search

How to stop automatic field extraction from creating separate fields for each case variant on the same field name

bmitchell
New Member

I have a log in which variations of case on the fieldname are causing automatic field extraction to create several fields where I would like only 1.

Example:

With entries like the following in the loglines:
requestor_Id=foo
Requestor_ID=bar
requestor_id=zoo

I would like to get only one case insensitive field extracted that collapses them all as "requestor_id"

The automatic field extractor was treating each case variant as a separate field. I setup a saved field extraction that was case insensitive and was able to give me one "good" field extraction that contains all of the data. However, the other case variants for the field name in the logs are still being extracted as well, and that's confusing to users.

Is there a way to tell automatic field extraction to NOT proceed with auto-extracting on the redundant field names (requestor_Id, Requestor_ID) so that only my one case insensitive field extraction called requestor_id is presented?

Thanks in advance!

0 Karma

khodges_splunk
Splunk Employee
Splunk Employee

Or use eval coalesce:

...| eval requestor_id=coalesce(requestor_Id, Requestor_ID, requestor_id)

This function takes an arbitrary number of arguments and returns the first value that is not null.

0 Karma

lguinn2
Legend

One solution would be to use Field Aliasing. You can find it in the Manager under Fields. This won't stop the automatic field extraction, but it will let you use a single common name.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...