topic Re: Translation from rex to IFX or props.conf in Getting Data In

Translation from rex to IFX or props.conf

royimad — Wed, 21 Aug 2013 20:11:23 GMT

I have the following query and i would like to preserve the extraction and not calling this extraction each time on a search

... | rex field=TotalCabinets "(?<DescriptionTotal>.*):(?<TotalCabinetsNbr>.*)" | table ...

How do i preserve "save" this extraction without calling it each time on my query, what is the translation of this query on Interactive field extraction or on props.conf?

Re: Translation from rex to IFX or props.conf

cpeteman — Wed, 21 Aug 2013 20:37:10 GMT

Whcih is the field you want TotalCabinets or TotalCabinetsNbr?

Re: Translation from rex to IFX or props.conf

royimad — Wed, 21 Aug 2013 20:39:21 GMT

TotalCabinets is already extracted and exist, I need to extract TotalCabinetNbr

TotalCabinets is like "Total Cabinets:293" and i need

Re: Translation from rex to IFX or props.conf

royimad — Wed, 21 Aug 2013 20:39:58 GMT

I need 293 the value wich is TotalCabinetNbr

Re: Translation from rex to IFX or props.conf

cpeteman — Wed, 21 Aug 2013 20:55:47 GMT

I'm not sure if you can extract information from another field if you extract that first field in the same props.conf file. Is that the case here?

Re: Translation from rex to IFX or props.conf

kristian_kolb — Wed, 21 Aug 2013 20:56:28 GMT

Assuming you have single-line events;
props.conf

[your_sourcetype]
EXTRACT-blah = (?m)Total\sCabinets:(?<TotalCabinetsNbr>\d+)

ought to work. If it doesn't, please post some sample events.

Note: Edited for multiline logs and the extra space.

Re: Translation from rex to IFX or props.conf

kristian_kolb — Wed, 21 Aug 2013 20:57:47 GMT

In my example below you see that the field is extracted straight from the event text. Not based off an extracted field.

Re: Translation from rex to IFX or props.conf

royimad — Wed, 21 Aug 2013 21:02:27 GMT

There are space between Total and Cabinets ,
can i use EXTRACT-blah = "Total Cabinets:"(?<TotalCabinetsNbr>\d+) ?

Re: Translation from rex to IFX or props.conf

royimad — Wed, 21 Aug 2013 21:04:52 GMT

Here is an example event:
Date = "20-Aug-2013 08:32:10 -0400"
From = "Roy Imad roy.imad@company.com"
To = "Roy Imad roy.imad@company.com"
Subject = "FW: [POSMonitor R1.5.1.0] DCPMonitor Inspection Summary"
mailbox = "splunk"
size = 12691
____________________ Message Body ____________________

DCPMonitor REPORT - Tue, Aug 20, 2013 at 00:00

Total Cabinets: 152, Offline Cabinets: 6
XPOS10027 - St ZZZZZZ Hospital of XXXXX - Cath Lab - Cath Room

Re: Translation from rex to IFX or props.conf

kristian_kolb — Mon, 28 Sep 2020 14:37:21 GMT

Apart from the edited regex above, you could also try (if TotalCabinets is already extracted).

EXTRACT-blah = some_regex in source_field

Haven't really played with that, but I assume that all 'in source_field' extractions take place after those that work on _raw. See the EXTRACT section of the props.conf docs.

http://docs.splunk.com/Documentation/Splunk/5.0.4/Admin/Propsconf