Splunk Search

Splunk_TA_windows, multiple src extractions

astatrial
Contributor

Hi all,

I have the Splunk_TA_windows and i noticed that there are multiple transforms-extract for field named src. 

For example:

- Client_Address_as_src

- Source_Network_Address_as_src

I am wondering what value the filed "src" will have if there are values for two or more of the source fields.

I need this because the Authentication DM has this field, and i want to know what the values that it uses. 

Thanks

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

You have to look at the names of the transforms and how they're laid out.  But it's a simple set of rules.

Consider

REPORT-aaa = extract_src2, extract_src1
REPORT-bbb = extract_src3

If those all apply to the same events, then...

REPORT-aaa applies two transforms, in the order they're written.  extract_src2 will happen before extract_src1.  If they both extract a field called 'src', then the last one extracted is the final value after that's been run.

THEN REPORT-bbb gets run.  Again, if it extracts a field called src (and actually extracts it because it matches, etc...) then it extracts src, overwriting whatever is there.

So, last to run overwrites all that came before it, assuming it actually extracts.

(That last is actually important.  You can try to extract field1 from a certain regex.  Then you can try to re-extract it from a different regex. If the second regex doesn't match the event, then it's not re-extracted, and it won't overwrite.  This is one of the ways to pile up a whole lot of different ways to extract a certain field.)

 

This is dense, but has all the answers:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence

And while ultimately it's linked from in that page above, here's the detailed look at the lexicographical ordering:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence#Lexicograp...

 

View solution in original post

Richfez
SplunkTrust
SplunkTrust

You have to look at the names of the transforms and how they're laid out.  But it's a simple set of rules.

Consider

REPORT-aaa = extract_src2, extract_src1
REPORT-bbb = extract_src3

If those all apply to the same events, then...

REPORT-aaa applies two transforms, in the order they're written.  extract_src2 will happen before extract_src1.  If they both extract a field called 'src', then the last one extracted is the final value after that's been run.

THEN REPORT-bbb gets run.  Again, if it extracts a field called src (and actually extracts it because it matches, etc...) then it extracts src, overwriting whatever is there.

So, last to run overwrites all that came before it, assuming it actually extracts.

(That last is actually important.  You can try to extract field1 from a certain regex.  Then you can try to re-extract it from a different regex. If the second regex doesn't match the event, then it's not re-extracted, and it won't overwrite.  This is one of the ways to pile up a whole lot of different ways to extract a certain field.)

 

This is dense, but has all the answers:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence

And while ultimately it's linked from in that page above, here's the detailed look at the lexicographical ordering:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence#Lexicograp...

 

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...