topic Re: EXTRACT-field command is not working in Splunk cloud for props.conf file in Splunk Enterprise

EXTRACT-field command is not working in Splunk cloud for props.conf file

vjsplunk — Tue, 12 Nov 2024 15:10:11 GMT

I am trying to add an EXTRACT-field command in Splunk cloud. I added the regex, it is working in search and capturing the value. But the field is not populating when applied to the props.conf file. The value I want to extract is "Stage=number". The regex I created is:

EXTRACT-Stage = Stage=(?<Stage>\d+)

What could be the reason?

Re: EXTRACT-field command is not working in Splunk cloud for props.conf file

PaulPanther — Thu, 14 Nov 2024 08:11:38 GMT

Please share some sample data and explain how and where you configured the props.conf.

Re: EXTRACT-field command is not working in Splunk cloud for props.conf file

vjsplunk — Thu, 14 Nov 2024 08:43:42 GMT

Sample logs looks like this:

adshdsfkdlfpofgsk message hdksodb Stage=8 gjhjyeomhf hjhdgy …

I deployed the configurations in the cloud instance from the settings > sourcetypes option.

Re: EXTRACT-field command is not working in Splunk cloud for props.conf file

PaulPanther — Thu, 14 Nov 2024 08:55:10 GMT

First, Key value pairs (field=value) are usually auto extracted when KV_MODE is set to auto in props.conf.

Configure automatic key-value field extraction - Splunk Documentation

If it is set to none please set your field extraction under Settings --> Fields --> Field extractions that's the right place for it.