...ngested into Splunk in "generic_single_line" format
- I have configured props.conf to extract fields using regular expression
- I have configured lookup table to enrich the event data (code -> l...
I have data like
whrchan-ros,FirstName,LastName,End User,Activated,Major Account,Group,Direct sales
I want to create a Company field at searchtime, which is the 3 character suffix. I have a f...
...ermissions for alias is "All apps" with read for Everyone. "uri" field is an inline field extraction. Search-timeoperation order puts inline field extraction (1st) ahead of field aliasing operations...
...ulti values, special characters and numbers of varying lengths. I would prefer to do this at searchtime in my props.conf / transforms.
Ideally I'd like to use something similar to a transforms s...
Hi,
How to perform a field extraction on a field from a lookup table?
I'm trying to add another field so the data model in Splunk Enterprise Security can recognise the field.
The issue i'm h...
Hello all,
The question is self explanatory I think. I've seen similar questions that are resolved with an eval, but in my case I'm trying to make everything automatic. Since thesequenceofsearch...
I extracted some fields from raw log , and I want to define field alias for them , but on specific field which is used in other indexes and has field alias ,the alias doesn't work .
I have:
1 Searchhead
1 Deployment Server
4 Indexers (Non clustered)
This is the raw CSV file:
date,name,capacity,free_capacity,virtual_capacity,used_capacity,real_capacity,overallocation,c...
The below EVAL function is working as search command, but not working when added as calculated field
myindex |EVAL trans_type=case('Trans Type' like "Ser Req%","Service Request",'Trans Type' l...
My automatic lookup is not working on fields that were created via FIELDALIAS's.
I have automatic lookups in my "search" app local/props.conf running on things like "src" and "dst" fields. The...