Splunk Search

Transform or extraction to explicitly set value based on regexp match

jcbrendsel
Path Finder

I woudl like to categorize some useragent patterns into several discrete groups.

That is, there are a number of different patterns that can appear that signify an iphone client.

one way of accomplishing this is to define a series of tags.

But I would like to do this using a transform / extraction, if at all possible.

that is, i want to create a field (at search time) which distills the various useragent patterns using a regexp into several discrete values (iphone, ipad, mac, etc.)

Is there a preferred approach?

Tags (2)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

The preferred approach for "classifying" events is to use either lookup tables or eventtypes. Lookup tables work best when there is a mapping (not necessarily one-to-one) between source and destination field values. Eventtypes allow mapping between arbitrary search statements (e.g., booleans, negations, disjunctions on keywords and fields) and categories.

Field extractions aren't ideal for this since, for efficiency, they make the assumption that the field value itself can be found in the source data. You can configure this assumption away in fields.conf, at a performance penalty.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...