Extract New Fields in Splunk

Extract New Fields in Splunk

The process by which Splunk extracts fields from event data and the results of that process, are referred to as extracted fields. Splunk extracts a set of default fields for each event it indexes. You can also create custom fields by defining additional index-time and search-time field extractions, using search commands, the field extractor, or configuration files.

In this article we will see how to extract custom fields from the event data:

In my blog "Configure a universal forwarder to monitor a log file on Linux", we have seen how to configure universal forwarder to monitor the linux server /var/log/messages file. We will use the event data from the same file to extract the message field. As you can see in the left pane of below screenshot that default fields extracted by Splunk does not contain the message field.

Steps to Extract New Field:

• Click on the "Extract New Fields" link on the bottom left corner of the event data search (as shown in above screenshot).
• On the new page click on a event to select a sample event.

• Click on "Next" and Select "Regular Expression"
• On the next screen, highlight the message part in the sample event. A popup window will come to provide the field name. Type the field name you want to provide. In my case I am giving the field name as "Message"

• Click on "Next" and Review your extraction. 

• If some events are still not included due to a little difference in the format, as shown in the below screenshot with red cross in front of them, then add one of them as sample event and provide field name in the popup window with the same name as "Message"

• Click Validate -> Save -> Finish
• You should now see the extracted field "Message" in the list of interested fields.