topic Re: Props.conf extractions in Getting Data In

Props.conf extractions

JoshuaJohn — Tue, 29 Sep 2020 10:40:44 GMT

Any reason why my statement for props.conf isn't showing up as an extracted field?

EXTRACT-kls_error = (?(kls_error_*)\w+)

When I use just the rex in a search it gets the exact info that I need but when I am trying to create an extracted field it cannot

MuS — Tue, 23 Aug 2016 20:54:31 GMT

Does it work if you run it in an ad-hoc search and is it just the format or are you missing a capturing group name?

diogofgm — Tue, 23 Aug 2016 21:05:33 GMT

I believe you are missing group name like MuS suggested. Try this

EXTRACT-kls_error = (?<kls_error>kls\_error\_[\w]+)

skoelpin — Tue, 23 Aug 2016 22:15:24 GMT

@diogofgm is correct, you need to put <NAME> in your expression

For troubleshooting, you could try the extraction via rex in the search bar to test it and see if it works

... | rex (?<kls_error>kls\_error\_[\w]+)