Splunk Search

Newbie to Splunk - Feild Extraction

Ak_C
New Member

I'm new to the Splunk Search and trying to learn it. I am not from Scripting BG so need help here. I have extraction configured for specific searches/reports now when i want to use the same in another report it 1) that Field extraction is not in the list 2) It is listed as a different name and I want it to be listed with a different name when another report sent for exmple:

  1. INT - extracts the Interfaces and I write a query like - index=ABC "duplex"| top hostname INT - where log is:

2013-06-14T07:40:10+00:00 10.51.88.34 Jun 14 09:40:09.253 CEST: %CDP-4-DUPLEX_MISMATCH: duplex mismatch discovered on GigabitEthernet0/2 (not half duplex), with ABCD FastEthernet2/0 (half duplex)

now I would want to use same INT Extractor listed in a different report with the name as INTERFACE - Is it possible?

Tags (2)
0 Karma

chris
Motivator

I don't quite understand your question do you just want to rename the field INT (probably not)? Then you can do the following:

index=ABC "duplex"| top hostname INT | rename INT as INTERFACE 

If the INT/INTERFACE field ist missing then the field extractions for that source/sourcetype are not configured yet.
-> I recommend you read the documentation about transforms & props

If the filed already exists but is called INTERFACE instead of INT you can create the following ( maybe after reading about props.conf) stanza in props.conf
$SPLUNK_HOME/etc/system/local/props.conf

[mySourceType]
FIELDALIAS-extract_ip = INTERFACE AS INT

If you need more help let me know

Chris

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...