Splunk Search

search time extraction on specific index

dgnatowski
New Member

I have 2 data inputs going to 2 separate indexes.  I have 2 different REGEX expressions to obtain IPAddress and Hostname.  How can I make it so only regex#1 is executed for index#1 and regex#2 is executed for index#2?  I have used EXTRACT and REPORT entries in props.conf to perform search-time field extractions, but both regex expressions get executed and I get erroneous data for IPAddress and Hostname fields.

What's the best way to handle this situation?

Sample data from data input #1:

Feb 1 14:15:17 10.106.198.22 1 2021-02-01T19:07:01.490Z w2k19_02.xxxBD.local

Sample data from data input #2:

Feb 1 14:46:43 10.106.5.72 Feb 1 19:53:23 vCM_01.xxxbd.local appliance: <134>1 2021-02-01T19:53:18.318369Z vCM_01.xxxbd.local

 

Labels (2)
0 Karma

tscroggins
Influencer

@dgnatowski 

Ensure you have properly defined hosts, sources, or source types for each event. After that, define your field extractions for the correct host, source, or source type. The index containing the event isn't normally relevant.

In your case, input #1 and input #2 have different formats and should be defined as different source type. If you're using a common source type, e.g. syslog, then define your extractions based on host or source.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...