punct

punct

noun

A field, the value of which is the pattern of the first thirty punctuation characters in the first line of the event with which it is associated. punct shows you what an event would look like if all of the letters, numbers, and spaces within it were removed, leaving only characters such as periods, colons, parentheses, quotes, question marks, dashes, and underscores.

For example, this event:

172.26.34.223 - - [01/Jul/2005:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953

Produces this punct value:

..._-_-_[:::_-]_\"_?=_/.\"__

punct is a default field that Splunk Enterprise extracts for each event it indexes. You can use it as a tool to search for similar events or identify types of events based on their punctuation structure.

For more information

In the Knowledge Manager Manual:

• Use default fields
• About event types
• Define and maintain event types in Splunk Web