Splunk Search

Transform or extraction to explicitly set value based on regexp match

jcbrendsel
Path Finder

I woudl like to categorize some useragent patterns into several discrete groups.

That is, there are a number of different patterns that can appear that signify an iphone client.

one way of accomplishing this is to define a series of tags.

But I would like to do this using a transform / extraction, if at all possible.

that is, i want to create a field (at search time) which distills the various useragent patterns using a regexp into several discrete values (iphone, ipad, mac, etc.)

Is there a preferred approach?

Tags (2)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.

Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...