Splunk Search

What's the order of search time field extraction

bowesmana
SplunkTrust
SplunkTrust

I have data like

whrchan-ros,FirstName,LastName,End User,Activated,Major Account,Group,Direct sales

I want to create a Company field at search time, which is the 3 character suffix. I have a field transform, which is

.*-(?<Company>[a-z]*$)

but I also want to convert any suffixes that are ros, to be rhk, so I have an eval calculated field of

Company=if(Company="ros","rhk",Company) 

If I use eval in the search command it works, but it's not working via the calculated field definition, so I guess it's an order issue.

How can I make that substitution after the Company has first been extracted.

Tags (3)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Calculated fields happen after field extractions (EXTRACT-aaa, REPORT-aaa). In your props.conf file enter the following and check again:

[my_sourcetype]
EXTRACT-company = .*-(?<Company>[a-z]*$)
EVAL-Company = if(Company="ros","rhk",Company)

View solution in original post

Lowell
Super Champion

Splunk now documents this very well. I highly recommend the The sequence of search-time operations page.

0 Karma

_d_
Splunk Employee
Splunk Employee

Calculated fields happen after field extractions (EXTRACT-aaa, REPORT-aaa). In your props.conf file enter the following and check again:

[my_sourcetype]
EXTRACT-company = .*-(?<Company>[a-z]*$)
EVAL-Company = if(Company="ros","rhk",Company)

bowesmana
SplunkTrust
SplunkTrust

I worked out why mine wasn't working, I had the EVAL-Company in the host::* section, but had the REPORT-Company in the sourcetype stanza and I read that precedence is host first, so my Company field did not exist when it tried to make the substitutions. Fixed that and it worked.

Thanks for all the comments.

0 Karma

_d_
Splunk Employee
Splunk Employee

No, in EXTRACT-xxx, the xxx can be anything as long as it's unique within a stanza. In EVAL-xxx, the xxx must be the field name.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Ensure that field name is same in both the stanza.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...