topic Re: Does SOURCE_KEY have the same limitations as EXTRACT in Splunk Search

Does SOURCE_KEY have the same limitations as EXTRACT

jwhughes58 — Mon, 29 Apr 2024 17:47:35 GMT

I'm working with a field named Match_Details.match.properties.user. It contains domain\user information that I'm trying to split into domain and user. I can't use EXTRACT in props.conf because of this restriction.

EXTRACT-<class> = [<regex>|<regex> in <src_field>] NOTE: <src_field> has the following restrictions: * It can only contain alphanumeric characters and underscore (a-z, A-Z, 0-9, and _).

Is this also true with REPORT in transforms.conf? I can't find any documentation that tells me.

TIA,

Joe

Re: Does SOURCE_KEY have the same limitations as EXTRACT

tej57 — Tue, 30 Apr 2024 08:15:52 GMT

Hello @jwhughes58 ,

Using REPORT, you generally call the transforms stanza that has the transformations written for extractions, routing, etc. You can simply write the regex that matches against _raw and extract the field required. If you use REPORT and call the transforms to extract the field, the same thing will happen.

If you necessarily want to use EXTRACT, you need to extract the Match_Details.match.properties.user field at index time and replace the (.) with (_). Then you'll be able to use EXTRACT parameter in props.conf for search time field extractions.

Additionally, you can also consider using rex command in the SPL query to extract the fields at search time.

Relevant documents:

https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf

https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Rex

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.

Re: Does SOURCE_KEY have the same limitations as EXTRACT

jwhughes58 — Tue, 30 Apr 2024 17:03:28 GMT

Thanks. Since transforms.conf doesn't have the limitations of EXTRACT, I finally got it working.