topic How to extract fields from a specific field instead of raw data using the conf files? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217299#M63836 <P>How to extract fields from a specific field instead of raw data using the conf files? Can it be done with EXTRACT-&lt;class&gt; = [&lt;regex&gt;|&lt;regex&gt; in &lt;src_field&gt;] in props.conf?</P> Mon, 02 Nov 2015 21:19:29 GMT rsimmons 2015-11-02T21:19:29Z How to extract fields from a specific field instead of raw data using the conf files? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217299#M63836 <P>How to extract fields from a specific field instead of raw data using the conf files? Can it be done with EXTRACT-&lt;class&gt; = [&lt;regex&gt;|&lt;regex&gt; in &lt;src_field&gt;] in props.conf?</P> Mon, 02 Nov 2015 21:19:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217299#M63836 rsimmons 2015-11-02T21:19:29Z Re: How to extract fields from a specific field instead of raw data using the conf files? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217300#M63837 <P>The extract fields command only works on raw data with transforms.conf however not with index data. The extractions is done via kv_mode=auto for the fields.</P> Mon, 02 Nov 2015 21:22:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217300#M63837 rsimmons 2015-11-02T21:22:10Z Re: How to extract fields from a specific field instead of raw data using the conf files? https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217301#M63838 <P>Hi rsimmons,</P> <P>Looks like this has already been answered here: <A href="https://answers.splunk.com/answers/47982/extracting-field-from-a-field-other-than-raw-in-props-conf.html">https://answers.splunk.com/answers/47982/extracting-field-from-a-field-other-than-raw-in-props-conf.html</A></P> <P>You need to use transforms configuration instead.</P> <P>Hope this helps.</P> Mon, 02 Nov 2015 21:24:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-fields-from-a-specific-field-instead-of-raw-data/m-p/217301#M63838 gcato 2015-11-02T21:24:54Z