Splunk Search
Highlighted

extract field from splunk directory structure

Path Finder

Hi all,

I am bit new for splunk, and facing a problem to create a field using regular expression. This field values should be populated by reading splunk directory structure. for example , I have below folders in my splunk directory structure. \Splunk\etc\apps\appName\logs\myField1\ \Splunk\etc\apps\appName\logs\myField2\ \Splunk\etc\apps\appName\logs\myField3\ \Splunk\etc\apps\appName\logs\myField4\

My need is to create a field say "MyFields" which will be populated automatically with directory names under \Splunk\etc\apps\appName\logs\ . In this case myField1, myField2, myField3, myField4. I have a regular expression which can fetch directory names under path \Splunk\etc\apps\appName\logs. But I am struggling to add such field in splunk application. Any help will be appreciated.

regards, S

0 Karma
Highlighted

Re: extract field from splunk directory structure

SplunkTrust
SplunkTrust

Hi snehalapatil

there are two way to achieve that, index-time or search-time field extraction. about index-time extraction you can read more here http://www.splunk.com/base/Documentation/latest/Admin/Configureindex-timefieldextraction

but as many answers state, index-time field extraction is not the best to do:

In general, we recommend search-time extractions rather than index-time extractions. There are relatively few cases where index-time extractions are better, and they come at the cost of brittleness of configuration and an increase in index size (which in turn makes searches slower).

this means you better use search-time field extraction and here is a good source on that topic: http://www.splunk.com/base/Documentation/latest/Knowledge/Createandmaintainsearch-timefieldextractio...

regards

View solution in original post