topic Splunk 6.3 Extract Fields Props.conf & transforms.conf not working in Getting Data In

Splunk 6.3 Extract Fields Props.conf & transforms.conf not working

icyfeverr — Tue, 27 Oct 2015 17:02:53 GMT

I setup a field extraction two ways, neither have worked and have caused Splunk to not function in a manner I think it should.

I setup a field extraction through the GUI and applied a transform through the GUI. Upon searching, the extraction is not shown, which would point me in the direction of my regex being incorrect, however, I do not believe this to be the case. The weird part is when I attempt to do a field extraction through the Wizard walk through, it takes me to a blank page now, and if I remove it the page now loads.

Since this did not work, I attempted to create the files manually in the app to see if the GUI was breaking it, but I got the same results as above. below is a copy of my props and transforms config files.

Props.conf:
[sr_info]
EXTRACT-id = id

Transforms.conf
[id]
MV_ADD = 1
REGEX = (?<id>(EI|EP|DK)\d{15})

Any ideas why this would be breaking the Wizard Walk through extraction page, the one you are able to click on via the event(s)?

FYI - When I do the extraction through the Wizard my regex is fine, it is rather simple anyways and wouldn't expect any issues from it.

Re: Splunk 6.3 Extract Fields Props.conf & transforms.conf not working

icyfeverr — Tue, 27 Oct 2015 17:04:16 GMT

Just to note, because it is not displaying in the post. There is a (backslash) in front of the d for 15 digits.

Re: Splunk 6.3 Extract Fields Props.conf & transforms.conf not working

icyfeverr — Tue, 27 Oct 2015 17:11:29 GMT

So, I kept digging and I see that I did a foobar. The props.conf file should not have EXTRACT in it for the transforms reference and should contain REPORT instead.

Changed from:
Props.conf:
[sr_info]
EXTRACT-id = id

To:
[sr_info]
REPORT-id = id

All is working now....Yay