Implementing Splunk 7 - Third Edition

Creating dynamic fields

Sometimes, it can be useful to dynamically create fields from an event. For instance, say we have an event, such as:

2012-08-25T20:18:09 action=send from_335353("[e-mail]") to_223523("[e-mail]") cc_39393("[e-mail]") cc_39394("[e-mail]") 

It would be nice to pull from, to, and cc as fields, but we may not know all of the possible field names. This stanza in transforms.conf would create the fields we want, dynamically:

[dynamic_address_fields] 
REGEX=s(S+)_S+("(.*?)") 
FORMAT = $1::$2 
MV_ADD=true 

While we're at it, let's put the numeric value after the field name into a value:

[dynamic_address_ids] 
REGEX=s(S+)_(S+)(" 
FORMAT = $1::$2 
MV_ADD=true

This gives us multivalue fields such as the ones in the following screenshot: ...