Splunk_TA_windows, multiple src extractions

[astatrial]

Hi all,

I have the Splunk_TA_windows and i noticed that there are multiple transforms-extract for field named src. 

For example:

- Client_Address_as_src

- Source_Network_Address_as_src

I am wondering what value the filed "src" will have if there are values for two or more of the source fields.

I need this because the Authentication DM has this field, and i want to know what the values that it uses. 

Thanks

[Richfez · Accepted solution]

You have to look at the names of the transforms and how they're laid out.  But it's a simple set of rules.

Consider

REPORT-aaa = extract_src2, extract_src1
REPORT-bbb = extract_src3

If those all apply to the same events, then...

REPORT-aaa applies two transforms, in the order they're written.  extract_src2 will happen before extract_src1.  If they both extract a field called 'src', then the last one extracted is the final value after that's been run.

THEN REPORT-bbb gets run.  Again, if it extracts a field called src (and actually extracts it because it matches, etc...) then it extracts src, overwriting whatever is there.

So, last to run overwrites all that came before it, assuming it actually extracts.

(That last is actually important.  You can try to extract field1 from a certain regex.  Then you can try to re-extract it from a different regex. If the second regex doesn't match the event, then it's not re-extracted, and it won't overwrite.  This is one of the ways to pile up a whole lot of different ways to extract a certain field.)

This is dense, but has all the answers:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence

And while ultimately it's linked from in that page above, here's the detailed look at the lexicographical ordering:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence#Lexicograp...