Hey everyone,
I am new to Splunk, and I need to create a new sourcetype along with field extractions. I am using regex expressions in props.conf and so far it is working well. But for the next field, the field name will depend on the value of two other fields that I have already successful extracted. Hence, my question is: is it possible to have a field that is only extracted depending on the values of other fields? And if these conditions aren't met then the field is not extracted at all?
For example, say we have two fields with these values in the logs.
If field_a = 1 AND field_b = a , then extract a field called c1 (which equals 1).
If field_a = 1 AND field_b != b , then do not extract anything.
If field_a = 4 AND field_b = b , then extract a field called c2 (which equals 4).
I know that this is easy to do in the search app interface on the web using SPL. But I want to be able to create this in the props.conf and so the field would be readily available while searching. Also, if this is possible, it would be a cool trick to learn.
Thank you.
↧