Splunk® Enterprise

Knowledge Manager Manual

Configure inline extractions

Inline field extractions are field extractions that are configured within props.conf.You can have one regular expression per field extraction configuration. See About configuration files in the Admin manual.

Use inline field extractions when you:

  • Have one regular expression per field extraction configuration
  • Have a simple setup with one regular expression, and you want to extract multiple fields
  • Want to create a new field by configuring an extraction

Inline extractions and the search-time operations sequence

Search-time operations order

Inline field extractions come second in the search-time operation sequence.


Because inline field extractions are near the top of the search-time operation sequence, they cannot reference fields that are derived and added to events by other search-time operations that come later.

For more information

For more information, see The sequence of search-time operations.

Configure an inline search-time field extraction

Inline search-time field extractions use the EXTRACT extraction configuration in props.conf. Each EXTRACT extraction stanza contains the regular expression to extract fields at search time, and other attributes that govern the way those fields are extracted.

Review the following topics.

Caution: Do not edit files in $SPLUNK_HOME/etc/system/default/. A subsequent upgrade or migration will overwrite your configuration and cause Splunk software to fail.


  1. Identify the source type, source, or host that provide the events that your field should be extracted from.
    All extraction configurations in props.conf are restricted to a specific source, source type, or host.
  2. Configure a regular expression that identifies the field in the event.
  3. Follow the format for the EXTRACT field extraction type to configure a field extraction stanza in props.conf that includes the host, source, or sourcetype for the event and the regular expression that you have configured.
  4. If your field value is a subtoken, you must also add an entry to fields.conf.
  5. Restart Splunk Enterprise.

EXTRACT field extraction configuration syntax

<spec> options

EXTRACT-<class> = [<regular_expression>|<regular_expression> in <string>]

Syntax: <source type>| host::<host> | source::<source> | rule::<rulename>| delayedrule::<rulename>

<spec> Description
<source type>
Source type of an event
Host for an event
Source for an event
Unique name of a source type classification rule.
Unique name of a delayed source type classification rule.

Before using rule or delayedrule, try generating a new source type based on the source seen by Splunk software.

EXTRACT configuration attributes

EXTRACT-<class> Description
A unique literal string that identifies the namespace of the field you're extracting. <class> values do not have to follow field name syntax restrictions and are not subject to key cleaning.
Required to have named capturing groups. Each group represents a different extracted field. When the <regular_expression> matches an event, the named capturing groups and their values are added to the event.
<regular_expression> in <source_field>
Matches a regular expression against the values of a specific field. Otherwise it matches all raw event data.
<regular_expression> in <string>
When <string> is not a field name, change the regular expression to end with [i]n <string> to ensure that Splunk software does not match <string> to a field name.
Last modified on 30 August, 2022
Configure custom fields at search time   Configure advanced extractions with field transforms

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.10, 8.1.0, 7.2.3, 8.0.8, 7.0.1, 8.0.7, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.2.0, 9.2.1, 9.2.2, 8.0.9, 8.1.1, 8.1.10

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters