topic Extract field from source field then run a lookup - config error? in Getting Data In

Extract field from source field then run a lookup - config error?

borgy95 — Mon, 28 Sep 2020 20:27:59 GMT

I want to add a field extracttion to props.conf that will extract a portion of the uri field to create a custom field called kap_uri.
So eventually i can do the following:

sourcetype=access_combined_wcookie kap_uri=* | lookup bad_url_lookup kap_uri OUTPUT maskid kap_uri | table kap_uri,maskid

According to the docs i expected this to work as follows:

 [host::mimi]
    EXTRACT-kap_uri = (?:(http\:\/\/www\.|\w+:\/\/|www\.|)(?<kap_uri>.+)) in uri

But when I search ("host=mimi kap_uri=* | table kap_uri") for the field in splunk nothing is returned.

After searching some more a transform.conf edit was suggested so i have tried,

#props.conf
[access_combined_wcookie]
REPORT-kap_uri = kapersky_uri

#transforms.conf
[kapersky_uri]
SOURCE_KEY = kap_uri
REGEX = (?:( http\:\/\/www\.|\w+:\/\/|www\.|)(?<kap_uri>.+))

Any ideas why this is not working, how can I get this field extraction,I tested the regex with rex field=uri "(?:(http\:\/\/www\.|\w+:\/\/|www\.|)(?<kap_uri>.+))" and it worked well

Re: Extract field from source field then run a lookup - config error?

woodcock — Thu, 02 Jul 2015 15:48:39 GMT

Your first method should have worked depending on the uri filed (for which you have not given any examples so we cannot help you further) and the host. For the first method, switch your stanza header from host-based to [access_combined_wcookie]. For your second method, you need to change SOURCE_KEY = kap_uri to SOURCE_KEY = uri.

Re: Extract field from source field then run a lookup - config error?

borgy95 — Mon, 06 Jul 2015 15:32:58 GMT

Thank you, The source key edit fixed it.