topic Re: Field extraction not working with transforms and props in Knowledge Management

Field extraction not working with transforms and props

lclayton95 — Tue, 06 Feb 2024 15:07:51 GMT

I am trying to extract some field values that comes in the following format

<date>00-mon-year</date> <DisplayName>example</DisplayName> <Hostname>example</Hostname>

When using the spl rex function i am able to extract the fields using

rex field=_raw "Hostname>(?<hostname>.*)<".

Then i have tried to use both a inline regex function in props with the same regex (without quotes) and it does not work. I have also used a transforms.conf with the stanza as follows

[hostname] FORMAT = Hostname::$1 REGEX = Hostname>(?<hostname>(.*?))</Hostname

then in the props

REPORT -Hostname = hostname

and this does not work.

However, i have another source that pulls the same type of logs and i am able to use inline regex in spl format just fine with no issues. This issue is only specific to this source which i have as

[source::/opt/*]

Any ideas on this fix?

Re: Field extraction not working with transforms and props

richgalloway — Tue, 06 Feb 2024 14:43:28 GMT

It's best to put sample data and configs in code blocks so the formatting is retained.

You say you tried an inline regex in props. Would you please share that? The transform shared looks like it should have worked. Please confirm the sourcetype in inputs.conf matches that in props.conf.

You have a source that works - how does that working config differ from the non-working one? Please share the complete stanzas so we can spot any differences.

Re: Field extraction not working with transforms and props

lclayton95 — Tue, 06 Feb 2024 20:48:00 GMT

In my indexes.conf there isn't a stanza specified for source type the lines i have are

[example] coldPath coldToFrozenDir enableDataIntergrity homePath thawedpath

The index in the props.conf that works is

[source::C:\\examplelogs*] EXTRACT-logs = Hostname>(?<hostname>(.*?))</Hostname

Re: Field extraction not working with transforms and props

richgalloway — Tue, 06 Feb 2024 22:16:04 GMT

Sourcetypes should match between inputs.conf and props.conf, except when props are specified for hosts or sources rather than sourcetypes. The indexes.conf file does not use sourcetypes.

The regex needs an escape character before the /. Also, the expression has two capture groups so make sure $1 is the group you expect. Or use a single group.

Hostname>(?<hostname>.*?)<\/Hostname