Splunk Search

Transform or extraction to explicitly set value based on regexp match

jcbrendsel
Path Finder

I woudl like to categorize some useragent patterns into several discrete groups.

That is, there are a number of different patterns that can appear that signify an iphone client.

one way of accomplishing this is to define a series of tags.

But I would like to do this using a transform / extraction, if at all possible.

that is, i want to create a field (at search time) which distills the various useragent patterns using a regexp into several discrete values (iphone, ipad, mac, etc.)

Is there a preferred approach?

Tags (2)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...