topic Re: Which of these field extractions defined in props.conf will Splunk consider for this field? in Splunk Search

Which of these field extractions defined in props.conf will Splunk consider for this field?

pavanae — Tue, 29 Sep 2020 11:40:35 GMT

I'd extracted 2 fields in props.conf as below:

[abc_xml_v1]
EXTRACT-abc_rac_cd_instance = ^/(cs|app)/abc/.*/adump/(?[^o][^_]+) in source
EXTRACT-abc_single_cd_instance = ^/(cs|app)/abc/(?[^/]+)/.*/adump/o in source

Which means I'd extracted two fields in a source with the same field name "cd_instance". In such cases, which extraction will Splunk consider for the field "cd_instance" ?

Any idea?

Re: Which of these field extractions defined in props.conf will Splunk consider for this field?

TStrauch — Thu, 03 Nov 2016 19:37:12 GMT

Hi,

Splunk always processes the props.conf sequential. Which means if you define the same field in two or more Extractions it will always be the value of the last called EXTRACT in props.conf.

Just give me a feedback if this is what you wanted to know. Im not quite sure about.