Can a field extraction be devised so that it has a default value when the regex is not matched?
I have defined an extracted field based on a regex which matches a specific pattern in an event. T...
...(metadata) fields for all my events. Is this possible?
For example, host, source, sourcetype (among others) are metadata fields given to me by default. I'd like to add the fields "site" and "ip" (t...
I'm working on a report that uses lot of fields. I would be extracting those fields across many sourcetypes. I have my personal username in splunk. This question just struck me,
"What is the default...
...omeone has an explanation for why I cannot use 'user=' on this install. I am also faced with having to use mvindex to extract information and Account_Name has multiple fields in Security logs so I w...
Hi,
I have below raw event. Data is ingested via reading logfiles from dedicated location on monitored server with UF on it. Splunk's default method is not extracting fields as I need. Some fields...
...everal fields in the record (e.g. stage and logtype). In some cases I can directly use the value from the record in some other cases not. I tried the following:
props.conf:
TRANSFORMS-i...
Hello. I am trying to route some events to a different index based on a field on the events. The events are JSON formatted. This is an example: {
"topic": "audits",
"e...
Hello * how can i overwrite the default eval definition for field app in props.conf? default/props.conf ...
EVAL-app = "Blue Coat ProxySG"
... I try to overwrite this field with f...
Hello, How would I implement inline or Uses Transform Field extraction (please see screenshot below) for following event (please see sample event below). Any help will be highly appreciated, thank y...