https://community.splunk.com/t5/Getting-Data-In/Why-do-my-inline-eval-statements-work-with-spath-but-do-not-as/m-p/411334#M72831 <P>EXTRACT works with regex, not with spath. You could try with EVAL statements in your props.conf.</P> <P>But it might make more sense to just apply something like KV_MODE = json in your props.conf. Or just get the splunk stream TA on your search heads, which should be able to handle all the field extraction stuff for such data I would say?</P> Mon, 26 Nov 2018 13:01:41 GMT FrankVl 2018-11-26T13:01:41Z https://community.splunk.com/t5/Getting-Data-In/Why-do-my-inline-eval-statements-work-with-spath-but-do-not-as/m-p/411333#M72830 <P>Why does this work:</P> <PRE><CODE>index=dns sourcetype=stream:dns | eval host_addresses=spath(_raw,"host_addr{}") | eval hostnames=spath(_raw,”hostname{}”) | eval message_types=spath(_raw,"message_type{}") | eval names=spath(_raw,"name{}") | eval queries=spath(_raw,"query{}") | eval query_types=spath(_raw,"query_type{}") | eval ttls=spath(_raw,"ttl{}") </CODE></PRE> <P>&nbsp;but this does not in props.conf:</P> <PRE><CODE>[stream:dns] EXTRACT-host_addresses = spath(_raw,"host_addr{}") EXTRACT-message_types = spath(_raw,"message_type{}") EXTRACT-hostnames = spath(_raw,"hostname{}") EXTRACT-names = spath(_raw,"name{}") EXTRACT-queries = spath(_raw,"query{}") EXTRACT-query_types = spath(_raw,"query_type{}") EXTRACT-ttls = spath(_raw,"ttl{}") </CODE></PRE> Mon, 26 Nov 2018 12:51:46 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-my-inline-eval-statements-work-with-spath-but-do-not-as/m-p/411333#M72830 jwalthour 2018-11-26T12:51:46Z https://community.splunk.com/t5/Getting-Data-In/Why-do-my-inline-eval-statements-work-with-spath-but-do-not-as/m-p/411334#M72831 <P>EXTRACT works with regex, not with spath. You could try with EVAL statements in your props.conf.</P> <P>But it might make more sense to just apply something like KV_MODE = json in your props.conf. Or just get the splunk stream TA on your search heads, which should be able to handle all the field extraction stuff for such data I would say?</P> Mon, 26 Nov 2018 13:01:41 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-my-inline-eval-statements-work-with-spath-but-do-not-as/m-p/411334#M72831 FrankVl 2018-11-26T13:01:41Z