Field Extraction from Source Field in props.conf

nwaller — Fri, 31 Aug 2018 19:25:57 GMT

Hello,

I am going bananas trying to figure out the error in my props.conf. All of my logs are collected using Splunk Enterprise and forwarded to a centralized server that I do not have CLI access to. I do all of my main configuration from the source host command line and forward the data to the centralized server. I need to extract a field called "microservice" from my source path. I have tested my regular expression in search with the following statement and it works.

host=myhostname sourcetype=log4j | rex field=source "^\/opt\/apps\/myapp\/microServices\/(?<microservice>\w+)\/.*"

Example path:
/opt/apps/myapp/microServices/neededDirectoryName/Logs/mylog_log.log

There are many directories that I am collecting logs from that are the same sourcetype: log4j. I am also only indexing error logs from this sourcetype as well, that is what the TRANSFORMS is for. I'll include my transform.conf for reference. I have other regular expressions extracting fields from the log events on Splunk web (on the centralized server).

props.conf:

[log4j]
EXTRACT-mspls = ^\/opt\/apps\/myapp\/microServices\/(?<microservice>\w+)\/.* in source
TRANSFORMS-set = nullqueue, errorlogs

transforms.conf:

[nullqueue]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue

[errorlogs]
REGEX = ^(\[ERROR\]|\[WARN\]|\[MANDATORY\])
DEST_KEY = queue
FORMAT = indexQueue

Thank you!!

Re: Field Extraction from Source Field in props.conf

richgalloway — Fri, 31 Aug 2018 20:43:56 GMT

What problem are you having? Is the field not getting extracted? The event not showing up? Something else?

topic Field Extraction from Source Field in props.conf in Getting Data In

Field Extraction from Source Field in props.conf

Re: Field Extraction from Source Field in props.conf