EXTRACT source field in props.conf has 'period'

Dworsnop — Fri, 28 Aug 2020 07:35:25 GMT

Hi all,

I've been trying to get an EXTRACT to work in a TA that someone has made for me and after much searching I have narrowed the problem down to the fact that the source field is "model.name". According to the props.conf docs, the source must be alphanumerical or an underscore, the docs also say that the source cannot be derived from a filed alias etc.

[mysourcetype]

...

EXTRACT-CIM_category = ^(?<category>.*):: in model.name

What is the best way therefore, to perform the regex extraction at search time on that field if I can't alias it? The docs say it can come from an preceding EXTRACT but what would the syntax be to rename the field to something like "model_name"? And how would this work because surely my source is always going to have the period in, which is incompatible with EXTRACT?

Many thanks in advance.

Re: EXTRACT source field in props.conf has 'period'

richgalloway — Fri, 28 Aug 2020 13:31:51 GMT

Have you tried not using the IN keyword and matching against _raw? You may need to modify the regex for it work against _raw.

Re: EXTRACT source field in props.conf has 'period'

Dworsnop — Fri, 28 Aug 2020 13:55:32 GMT

Thanks @richgalloway that's worked!

topic EXTRACT source field in props.conf has 'period' in Getting Data In

EXTRACT source field in props.conf has 'period'

Re: EXTRACT source field in props.conf has 'period'

Re: EXTRACT source field in props.conf has 'period'