Can a field extraction be devised so that it has a default value when the regex is not matched?
I have defined an extracted field based on a regex which matches a specific pattern in an event. T...
...(metadata) fields for all my events. Is this possible?
For example, host, source, sourcetype (among others) are metadata fields given to me by default. I'd like to add the fields "site" and "ip" (t...
I'm working on a report that uses lot of fields. I would be extracting those fields across many sourcetypes. I have my personal username in splunk. This question just struck me,
"What is the default...
...omeone has an explanation for why I cannot use 'user=' on this install. I am also faced with having to use mvindex to extract information and Account_Name has multiple fields in Security logs so I w...
...everal fields in the record (e.g. stage and logtype). In some cases I can directly use the value from the record in some other cases not. I tried the following:
props.conf:
TRANSFORMS-i...
I have logs that do not use the default name value format for the user field. When I add a field extractor for my user format and name it "user", the default format of "user=" no longer is i...
Ex:
sourcetype=abcd [search sourcetype=xyz field1=200 | table field2,field3,field4] which will be literally
sourcetype=abcd [search field2="returned value" AND field3="returned value" AND field...
I have a csv lookup table with 3 columns, eg:
input1,input2,output
240,789,303456
240,330,303457
240,default,303458
246,345,249580
246,330,249589
246,default,230444
The fields to m...
...X): KKDOMAIN'
Sun Jun 11 10:30:23 2017 Info: Double bounce: MID 221212 to 0 - 5.4.7 - Delivery expired (message too old) [Default] 451-'Open is not allowed please check'
I need the
field1="B...