Splunk Search

How to add a field extraction to an existing default field?

CREVITCH
Path Finder

I have logs that do not use the default name value format for the user field. When I add a field extractor for my user format and name it "user", the default format of "user=" no longer is included in the search. How to I add to the existing field rule rather than replace it?

0 Karma
1 Solution

renjith_nair
Legend

Try adding a different field name instead of user for field extraction and then use a field alias to link both

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can do it like this :

props.conf:

[YourSourcetypeHere]
REPORT-SomeArbitraryUniqueStringHere = UserFieldMultipleFormats

transforms.conf:

[UserFieldMultipleFormats]
REGEX = (?:session (?:closed|opened) for|disconnected by|[Ii]nvalid|about|check pass;) user (\w+)
FORMAT = user::$1
0 Karma

renjith_nair
Legend

Try adding a different field name instead of user for field extraction and then use a field alias to link both

http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Addaliasestofields

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

CREVITCH
Path Finder

I have a number of formats for user. How can I create a field extractor that will cover all of them:

session closed for user XXXX
session opened for user XXXX
disconnected by user XXXX
invalid user XXXX
about user XXXX
check pass; user unknown
Invalid user XXXX
user=XXXX (default built into linux_secure)

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...