topic Re: Field Extraction from Indexed field in Security

Field Extraction from Indexed field

Poojitha — Fri, 03 May 2024 12:10:50 GMT

Hi All,

I am trying to extract a value from the indexed field. i.e from source field . I have added the regex in props.conf

Example :

source = 234234324234:us-west-2:firehose_list_tags_for_resource

I want everything after second : (colon) as service i.e firehose_list_tags_for_resource

I have added in props.conf as below :

EXTRACT-service = source([^:]+:[^:]+:(?<service>.+)$)

This has created the field service but fetching wrong value. It is fetching last part of raw data.

Please can anyone help me to understand how can I extract field value from indexed data ? Should I add in transforms.conf as well ?

Please can anyone guide me. It helps me lot

Regards,
PNV

Re: Field Extraction from Indexed field

gcusello — Fri, 03 May 2024 12:36:22 GMT

Hi @Poojitha,

please try this:

| rex field=source ":(?<your_field>\w+)$"

or in props.conf:

EXTRACT-service = EXTRACT-service = source([^:]+:[^:]+:(?<service>.+)$) in source

that you can test at https://regex101.com/r/NBjX8h/1

ciao.

Giuseppe

Re: Field Extraction from Indexed field

deepakc — Fri, 03 May 2024 12:42:28 GMT

Use the below as an example, using both props and transforms, change to your sourcetype that you are using and if it works, change your group names if desired.

Props.conf
[my_sourcetype]
REPORT-my_service = extract_service

Transforms.conf
[extract_service]
SOURCE_KEY = source
REGEX = [^:]+:(?<my_service>.+)$
FORMAT = my_service::$1

Re: Field Extraction from Indexed field

richgalloway — Fri, 03 May 2024 12:43:25 GMT

Tell Splunk which field to extract from by using the in option.

EXTRACT-service = [^:]+:[^:]+:(?<service>.+)$ in source