Configure inline extractions
See About configuration files in the Admin manual.
Inline extractions and the search-time operations sequence
Search-time operations order
Inline field extractions come first in the search-time operation sequence.
Because inline field extractions happen first in the search-time operation sequence, they cannot reference fields that are derived and added to events by other search-time operations.
For more information
For more information, see The sequence of search-time operations.
Configure an inline search-time field extraction
Inline search-time field extractions use the EXTRACT extraction configuration in
props.conf. Each EXTRACT extraction stanza contains the regular expression to extract fields at search time, and other attributes that govern the way those fields are extracted.
Review the following topics.
- About default fields (host, source, source type, and more) for information about hosts, sources, and sourcetypes.
- fields.conf for information about adding an entry to
- Regular expressions and field name syntax for information about field-extracting regular expressions.
- Create a field from a subtoken for information on subtokens.
- Access to the
$SPLUNK_HOME/etc/system/local/, or in your custom app directory in
Caution: Do not edit files in
$SPLUNK_HOME/etc/system/default/. A subsequent upgrade or migration will overwrite your configuration and cause Splunk software to fail.
- Identify the source type, source, or host that provide the events that your field should be extracted from.
All extraction configurations in
props.confare restricted to a specific source, source type, or host.
- Configure a regular expression that identifies the field in the event.
- Follow the format for the EXTRACT field extraction type to configure a field extraction stanza in
props.confthat includes the host, source, or sourcetype for the event and the regular expression that you have configured.
- If your field value is a subtoken, you must also add an entry to
- Restart Splunk Enterprise.
EXTRACT field extraction configuration syntax
[<spec>] EXTRACT-<class> = [<regular_expression>|<regular_expression> in <string>]
Syntax: <source type>| host::<host> | source::<source> | rule::<rulename>| delayedrule::<rulename>
||Source type of an event|
||Host for an event|
||Source for an event|
||Unique name of a source type classification rule.|
||Unique name of a delayed source type classification rule.|
delayedrule, try generating a new source type based on the source seen by Splunk software.
EXTRACT configuration attributes
||A unique literal string that identifies the namespace of the field you're extracting. <class> values do not have to follow field name syntax restrictions and are not subject to key cleaning.|
||Required to have named capturing groups. Each group represents a different extracted field. When the <regular_expression> matches an event, the named capturing groups and their values are added to the event.|
||Matches a regular expression against the values of a specific field. Otherwise it matches all raw event data.|
||When <string> is not a field name, change the regular expression to end with [i]n <string> to ensure that Splunk software does not match <string> to a field name.|
About regular expressions with field extractions
Configure advanced extractions with field transforms
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2