topic Re: Index time Search Not Working in Splunk Search

Index time Search Not Working

NAVEEN_CTS — Wed, 08 May 2019 14:10:39 GMT

Hi ,

I have dns file where i need to filter the junk data before indexing and extract hostname and IP fields at index time.

Filtering logic works well
Regex works well. It is tested in splunk search.
I get only 1 field extracted (IP alone) and HostName is not extracted.

Below are my configurations.Please review and let me know if something missing

Props.conf
[dig]
TRANSFORMS-drop = delLines
TRANSFORMS-dnsExtract = hostExtraction
TRANSFORMS-dnsExtract = IPExtraction

Transforms.conf

[delLines]
REGEX = ^;.*$
DEST_KEY = queue
FORMAT = nullQueue

[hostExtraction]
REGEX = ^(?P[^\t]+)

FORMAT = HostName::"$1"

WRITE_META = true

[IPExtraction]
REGEX = (?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})

FORMAT = IP::"$1"

WRITE_META = true

NAVEEN_CTS — Wed, 08 May 2019 14:12:40 GMT

I missed adding fields.conf

Fields.conf
[HostName]
INDEXED = true

[IP]
INDEXED = true

koshyk — Wed, 08 May 2019 18:51:30 GMT

The reason i guess is you made a small mistake of using same name within props.conf . Please try like below

[dig]
TRANSFORMS-drop = delLines
TRANSFORMS-dnsExtract1 = hostExtraction
TRANSFORMS-dnsExtract2 = IPExtraction

woodcock — Wed, 08 May 2019 20:07:12 GMT

I agree with @koshyk but I would probably fix it like this:

Props.conf

[dig]
TRANSFORMS-drop = delLines
TRANSFORMS-dnsExtract = hostExtraction, IPExtraction

NAVEEN_CTS — Thu, 09 May 2019 05:24:51 GMT

@koshyk Thank you .....it worked 🙂

NAVEEN_CTS — Thu, 09 May 2019 05:25:40 GMT

@woodcock Thank you it worked 🙂