topic How to EXTRACT regex expression in props.conf? in Getting Data In

How to EXTRACT regex expression in props.conf?

greggz — Wed, 07 Feb 2018 17:43:40 GMT

I have this file with this appearance

first.prop.one=1
first.prop.two=2
first.prop.third=3

I was using KV_MODE=Auto, but I need more than 100 results. So I went to the HF, in the sourcetype definitions added

[sourcetype]
EXTRACT-Property=(?<Property>.+)=(?<Value>.+)

But nothing changed. Am I extracting correctly ?

thanks

micahkemp — Wed, 07 Feb 2018 17:54:46 GMT

EXTRACT and REPORT are search time objects, and need to be in place on the search head (not the forwarder).

I'd also suggest setting KV_MODE = none to avoid potential conflicts.

greggz — Wed, 07 Feb 2018 17:59:25 GMT

Ohhh right. Anyway, is the regex correct ?

DUThibault — Wed, 07 Feb 2018 18:02:20 GMT

It looks okay, but just to be sure I'd write it as (?<Property>[^=]+)=(?<Value>.+)