Splunk Search

Splunk Field Extraction

Path Finder

I have indexed few sample logs in to the Splunk..

2020-02-15T10:41:54.305Z servername.com sev="INFO" msgdetails="Audit success" polname="policy_name"

Splunk by default extract the fields sev, msgdetails, polname and extract the values appropriately. Everything loos good.

For me, i need to rename the field as severity instead of sev, Description instead of msgdetails and Policies instead of polname.

I have updated the props.conf

[sourcetype]
FIELDALIAS-severity = sev AS Severity
FIELDALIAS-msg_details = msg_details AS Description
FIELDALIAS-pol_name = pol_name AS Policies

Fields are extracting properly.

When i run the search on Verbose Mode, i can see both sev and Severity, which is quiet annoying for the Analysts

Is it normal or do i have to write a EXTRACT function with appropriate REGEX in order to show only the Severity field NOT sev.

0 Karma
1 Solution

Legend

Hi @cyber_castle,
Yes it's normal:

  • if you create an alias you have both the fields,
  • also using a regex you continue to have all the automatic field extractions so you'll have both the field names.

the only way to avoid to have both the field names is to insert a rename in all your searches.

Ciao.
Giuseppe

View solution in original post

0 Karma

Legend

Hi @cyber_castle,
Yes it's normal:

  • if you create an alias you have both the fields,
  • also using a regex you continue to have all the automatic field extractions so you'll have both the field names.

the only way to avoid to have both the field names is to insert a rename in all your searches.

Ciao.
Giuseppe

View solution in original post

0 Karma

Path Finder

Thanks a lot for your prompt response.

0 Karma