topic Re: Unable to extract fields from source in Splunk Search

Unable to extract fields from source

siddharthmis — Thu, 21 Dec 2017 11:16:56 GMT

I have props.conf defined as-

[source::C:\Web\...\...\Web\log\mobile.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

[source::C:\Web\...\...\Web\log\web.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

I am still unable to index the two fields. What am I doing wrong?
Do I need to make some other changes?

Re: Unable to extract fields from source

abhijeet01 — Thu, 21 Dec 2017 12:53:34 GMT

Hi @siddharthmis

can you please share your source string

Re: Unable to extract fields from source

p_gurav — Tue, 29 Sep 2020 17:20:35 GMT

Hi siddharthmis,

you can try rex command on source field:
| rex field=source "\w+:\\w+\(?P\w*)\(?P\w*)\.*"

Re: Unable to extract fields from source

DavidHourani — Thu, 21 Dec 2017 12:55:34 GMT

Hello Siddharthmis,

Your problem is not in the regex, it is in the stanza.

the stanzas should look like this :

 [source::C:\Web\*\*\Web\log\mobile.log]
 EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

 [source::C:\Web\*\*\Web\log\web.log]
 EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

please refer to the following question for more details:
https://answers.splunk.com/answers/31643/using-source-for-field-extraction-in-props-conf.html

Regards,
David

Re: Unable to extract fields from source

siddharthmis — Fri, 22 Dec 2017 07:08:35 GMT

Thanks, it worked.

[<SOURCETYPEHERE>]
  EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

[<SOURCETYPEHERE>]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

I used the above, though.

Re: Unable to extract fields from source

DavidHourani — Fri, 22 Dec 2017 08:53:12 GMT

Great! Please accept and up vote answer 🙂