topic Issue with extracting multifield values due to props.conf transform.conf settings in Splunk Search

Issue with extracting multifield values due to props.conf transform.conf settings

vikas_gopal — Fri, 03 Nov 2017 18:36:27 GMT

Hi Experts,

I am trying to extract something like below
type=type1,type3

My Data
event1.epochtime=1282182111 type=type1 value=value1 type=type3 value=value3

props.conf
[test]
REPORT-type = mv-type

transform.conf
[mv-type]
REGEX = type=(?type\s+)

MV_ADD = true

Now when I restart after above , I still see only one value in type, so result is type=type1 only . May I know what I am doing wrong ?

Regards
VG

Re: Issue with extracting multifield values due to props.conf transform.conf settings

vikas_gopal — Fri, 03 Nov 2017 18:46:42 GMT

I am taking help from below doc and using same example from here
http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Exampleconfigurationsusingfieldtransforms

Re: Issue with extracting multifield values due to props.conf transform.conf settings

somesoni2 — Fri, 03 Nov 2017 18:54:27 GMT

Use captital S in your REGEX instead of small case.

REGEX = type=(?<type>\S+)

See the comment from @Daljeanis at the bottom on the documentation.

Re: Issue with extracting multifield values due to props.conf transform.conf settings

kamlesh_vaghela — Fri, 03 Nov 2017 18:55:37 GMT

Can you please try below configuration?

props.conf

[test]
REPORT-type = mv-type

transform.conf

[mv-type]
REGEX = type=(?<type>[^\s+]*)
MV_ADD = true

Thanks

Re: Issue with extracting multifield values due to props.conf transform.conf settings

vikas_gopal — Fri, 03 Nov 2017 19:02:03 GMT

Thanks mate I should have seen this before ..lolz it works

Re: Issue with extracting multifield values due to props.conf transform.conf settings

vikas_gopal — Fri, 03 Nov 2017 19:03:03 GMT

Well it works , I should have seen the comment which was mentioned at the below of the document . So it was the regex problem . Thanks for your response man