topic Using SPATH notation in conf files in Getting Data In

Using SPATH notation in conf files

danielwysockiar — Fri, 31 Aug 2018 11:58:11 GMT

Hi guys,
I need to uto extract fields and values during search time using SPATH notation in props.conf and transforms.conf filles.
I know that there are more convinient ways to do that, but I have to do it this way.

I know how to use spath in SPL, but can someone let me know what the syntax in the .conf file should look like?
I cannot not find it in any docs or answers.
Thank in advance.

Re: Using SPATH notation in conf files

sudosplunk — Fri, 31 Aug 2018 12:12:47 GMT

Hi,

Are you looking for this?

Re: Using SPATH notation in conf files

danielwysockiar — Fri, 31 Aug 2018 12:22:44 GMT

Not exactly, I need search-time extraction defined in .conf files, not indexed extractions.
I can not find how to use spath in props.conf.

Re: Using SPATH notation in conf files

sudosplunk — Fri, 31 Aug 2018 12:28:14 GMT

KV_MODE is used for search-time field extractions only. These are the values you can set for KV_MODE,

none: if you want no field/value extraction to take place.
- auto: extracts field/value pairs separated by equal signs.
- auto_escaped: extracts fields/value pairs separated by equal signs and honors \" and \ as escaped sequences within quoted values, e.g field="value with \"nested\" quotes"
- multi: invokes the multikv search command to expand a tabular event into multiple events.
- xml : automatically extracts fields from XML data.
- json: automatically extracts fields from JSON data.