field "punct" meaning

[rashid47010]

Hi everyone,

I am seeing "punct" field against almost all indexes. what does that mean.

[paimonsoror]

I find the field to be a great tool when I am trying to come up with a regex for field extractions. Sometimes you come up with a base search and no matter how hard you try to limit the results to a certain subset, there will always be some outliers. Punct is a fantastic way to quickly point you to the outliers that didn't match the pattern you expected. Huge help when building regex and accounting for variations of results in your base search.

[somesoni2]

See this

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Usedefaultfields#punct

[niketn]

@rashid47010... punct is default indexed fields which are patterns of punctuation within events. You can directly search for events belonging to to specific pattern.

[jplumsdaine22]

Maybe someone from splunk can confirm but I believe technically it is _raw with all the spaces and tokens removed