Splunk Search

field "punct" meaning

rashid47010
Communicator

Hi everyone,

I am seeing "punct" field against almost all indexes. what does that mean.

Tags (2)
0 Karma

paimonsoror
Builder

I find the field to be a great tool when I am trying to come up with a regex for field extractions. Sometimes you come up with a base search and no matter how hard you try to limit the results to a certain subset, there will always be some outliers. Punct is a fantastic way to quickly point you to the outliers that didn't match the pattern you expected. Huge help when building regex and accounting for variations of results in your base search.

somesoni2
Revered Legend

niketn
Legend

@rashid47010... punct is default indexed fields which are patterns of punctuation within events. You can directly search for events belonging to to specific pattern.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jplumsdaine22
Influencer

Maybe someone from splunk can confirm but I believe technically it is _raw with all the spaces and tokens removed

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...