Static Fields

[tepus]

Hi everyone,

I'm going through the course Splunk Fundamentals 2 and I'm sorry if the question is too easy: what does it mean for a field to be 'static'? Namely, in the slide 151 of Splunk 7.X Fundamentals Part 2 (IOD).pdf, it is stated:
'Use FX to extract fields that are static...'
But I couldn't find any definition of a 'static' field in the documentation. What does it mean?

Any help is appreciated!

[tepus · Accepted solution]

Hi again,

Here is a just-received answer from an official Splunk instructor from the Splunk Fundamentals 2 course:

In the context of field extraction, "static" means that the value of the field will not change in terms of the regex created to extract that field. After the regex is created, Splunk will extract only the results of that regex - any change will result in the regex not working, and produce an error.

[gcusello]

Hi @tepus,
I don't know what they mean with "static", I can suppose that they would mean "stable" and available for searches, in other words, fields extracted with FX are available for others searches , instead if you extract a field using the rex command, field is useful only in that search.

ciao.
Giuseppe

[tepus]

It makes sense to me. Thanks @gcusello !

[gcusello]

Hi @tepus,
if this answer solves your problem, please accept and/or upvote it for the other members of Community.
Ciao and next time.
Giuseppe