topic Re: Field extraction and Splunk forwarding in Splunk Search

Field extraction and Splunk forwarding

lrhazi — Fri, 13 Jul 2012 13:03:04 GMT

I have systems sending data to splunk1 in the form: k1=v1 k2=v2
I have field extraction configured for the sourcetype,to extract those fields as name1 and name2. This works fine.
I have another system sending similar data to splunk2, which is configured to route it, based our "source" to splunk1.

the data from this remote system, though it has the correct sourcetype, does not get my custom field extraction applied, instead I get the automatic fields extracted with thier short names, k1, k2.

I tried adding my extraction rules to props/transforms on splunk2, in addition to splunk1, but to no avail. How can I fix this?

Re: Field extraction and Splunk forwarding

lguinn2 — Fri, 13 Jul 2012 16:53:21 GMT

Are your field extractions search-time or index-time? They should be search-time. Can you post your props.conf and transforms.conf so we can see them?

If your field extractions are index-time, they will not apply retroactively to data that has already been indexed. (One of the several disadvantages of index-time fields.) Search-time field extractions apply to all data, regardless of when it was indexed.

If you aren't sure whether your field extractions are search-time or index-time, check out the links below. Also, we will be able to tell once we see the .conf files.
Useful links:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Indextimeversussearchtime

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles

Re: Field extraction and Splunk forwarding

lrhazi — Fri, 13 Jul 2012 17:04:25 GMT

Thanks a alot.. My extractions are like what follows.. I guess index-time?

props.conf:

[bigip-syslog]
REPORT-gtm-dns-fields = gtm-dns-fields-1

transforms.conf:
[gtm-dns-fields-1]
REGEX = v=([\d.]+):? c=([\d.]+)
FORMAT = vip::$1 client::$2

Re: Field extraction and Splunk forwarding

lrhazi — Fri, 13 Jul 2012 17:17:17 GMT

Thanks a lot for the links... which lead me to "Field aliasing", which is really all I needed, Splunk already parses and extract my fields correctly, just needed them renamed, and aliasing seems to work just fine too!

Re: Field extraction and Splunk forwarding

lguinn2 — Fri, 13 Jul 2012 18:32:35 GMT

Glad it worked. This is search-time field extraction BTW.