Documentation:
3.0.2
This page last updated: 01/24/08 10:01am
How fields work
A field is any searchable name/value pair in an event. A field is distinguished from the free-form indexed segments of an event in that fields are labeled and can be searched by label. For example, host::foo is a field whose name is host and value is foo. You can search on any field name or specific value of a field. Fields are also useful for running reports.
Search fields vs extracted fieldsFields are categorized by how and when they are processed. The two major categories are search fields and extracted fields.
Search fields are captured in real time as events are processed and indexed by Splunk. Information on where the event came from, what type of event, source type, etc, are extracted by Splunk's input processor. You can configure Splunk to index new search fields. Search fields can be used to create granular access controls or new event types.
Extracted fields are created at search time. Splunk picks out obvious name/value pairs in search results, such as user_id or client_ip. This dynamic extracted field list can be used in filters and reports. You can configure Splunk to create new extracted fields. Extracted fields cannot be used to create granular access controls or new event types.
The process for defining new fields is nearly the same for search and extracted fields.
- Determine a pattern to identify the field in the event.
- Write a regular expression to extract the field from the event.
- Edit props.conf and transforms.conf files in $SPLUNK_HOME/etc/bundles/local/.
- In the props.conf file, specify either the source, source type or host containing the events for processing and assign a name which will identify the transform in transforms.conf.
- In transforms.conf, create the named transform stanza, and supply the regex to extract the field.
- For search fields, write this information to the index.
You can turn off fields in SplunkWeb, either on the fly or permanently. To disable fields for a specific search, append | kv auto=false to your search:
sourcetype::access_combined | kv auto=false
If you want to permanently disable fields for a specific source, sourcetype or host, add a KV_MODE = none attribute/value pair for the appropriate data in props.conf:
[<spec>] KV_MODE = none
<spec> can be:
1. <sourcetype>, the sourcetype of an event
2. host::<host>, where <host> is the host for an event
3. source::<source>, where <source> is the source for an event
Search and extracted fields are configured through a combination of props.conf and transforms.conf. Before manually modifying any configuration file, please read about bundle files.
Comments
No comments have been submitted.