topic REGEX not working in transforms.conf in Splunk Search

REGEX not working in transforms.conf

jhallur_splunk — Tue, 08 Jul 2014 23:27:31 GMT

Here is my event:

Contact=" (Contact){ Id -- '123' Email -- 'johnny@gmail.com' Name -- 'Johnny blah' Phone -- '3333337856' }”

my props.conf

[ST_CONTACT_INFO]
BREAK_ONLY_BEFORE = Contact=
MAX_TIMESTAMP_LOOKAHEAD = 150
REPORT-contact1 = report-contactdetails
NO_BINARY_CHECK = 1
pulldown_type = 1

my transforms.conf

[report-contactdetails]
SOURCE_KEY = Contact
REGEX = [\s]([\w]+)[\s]--[\s]\'([^\']+)
FORMAT = $1::$2
MV_ADD = true

The fields like Id , Email, Name and Phone numbers are not auto extracted. The REGEX works fine and tested on regex101.com , check at http://regex101.com/r/tP2wB5/2
When I put the configuration in props.conf and transforms.conf, why it is not working? I have ensured that I gave the correct SOURCETYPE for the input.

Re: REGEX not working in transforms.conf

martin_mueller — Tue, 08 Jul 2014 23:41:09 GMT

To narrow possible causes down please comment out the SOURCE_KEY - your extraction should still match on the _raw text as shown by your URL.

Re: REGEX not working in transforms.conf

jhallur_splunk — Tue, 08 Jul 2014 23:51:44 GMT

Yes, it worked, but this overwrites the originally auto extracted field "Contact" with value single quote only. i.e Contact="

Re: REGEX not working in transforms.conf

martin_mueller — Tue, 08 Jul 2014 23:55:11 GMT

So it seems the field Contact isn't available at the time of that REPORT application.

Re: REGEX not working in transforms.conf

jhallur_splunk — Wed, 09 Jul 2014 00:27:15 GMT

Please put your answer in the answer text box below so that I can accept it.

Re: REGEX not working in transforms.conf

martin_mueller — Wed, 09 Jul 2014 00:31:59 GMT

Yup, done.