https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-to-further-extractions-from-an-existing-search/m-p/228413#M67530 <P>Looks like I've just answered my own question.</P> <P>The documentation states to use field (for single) or fields (for multiple), but as soon as I removed field and left "SOURCE_KEY = message", it worked as expected perfectly. Now to go deeper and try a JSON parse on one of the extracted fields...</P> Thu, 12 Jan 2017 21:14:17 GMT splunkto 2017-01-12T21:14:17Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-to-further-extractions-from-an-existing-search/m-p/228412#M67529 <P>Currently I'm doing an extraction on a log file like so:</P> <PRE><CODE>[AUDIT_PARSE] REGEX = \x5b[^\x5d]+\x5d\s+(\w+)\s+(?:\x7b([^\x7d]+)\x7d){0,1}\x2d\s+(.*) FORMAT = level::$1 log_source::$2 message::$3 </CODE></PRE> <P>One of the extracted fields you see is 'message', which itself has a number of key value pairs. I then want to take the extracted 'message', and parse those pairs.</P> <PRE><CODE>[AUDIT_MESSAGE_PARSE] REGEX = \s*(\S+)\s*\x3a\s*((?:[^\x7c\x5d])+?)\s*(?:\x7c|$) SOURCE_KEY = field:message FORMAT = $1::$2 </CODE></PRE> <P>One of those key value extractions has another field I want parsed, so I do another one on that field:</P> <PRE><CODE>[INITIATOR_PARSE] SOURCE_KEY = field:Initiator REGEX = ^(.*?)\x2f([^\x40]+)(?:\x40(.+)){0,1}$ FORMAT = SSO_Organization::$1 SSO_User::$2 SSO_Domain::$3 </CODE></PRE> <P>I put them all together with the following in props:</P> <PRE><CODE>TRANSFORMS-audit = AUDIT_PARSE, AUDIT_MESSAGE_PARSE, INITIATOR_PARSE </CODE></PRE> <P>Right now AUDIT_PARSE runs and works, but the remainder does not work. If i remove the SOURCE_KEY it 'runs', but it will run in _raw instead of the pre-extracted field. Is this a splunk limitation where I need to do this at Index time, or am I missing something?</P> <P>Thanks!</P> Tue, 29 Sep 2020 12:22:29 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-to-further-extractions-from-an-existing-search/m-p/228412#M67529 splunkto 2020-09-29T12:22:29Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-to-further-extractions-from-an-existing-search/m-p/228413#M67530 <P>Looks like I've just answered my own question.</P> <P>The documentation states to use field (for single) or fields (for multiple), but as soon as I removed field and left "SOURCE_KEY = message", it worked as expected perfectly. Now to go deeper and try a JSON parse on one of the extracted fields...</P> Thu, 12 Jan 2017 21:14:17 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-to-further-extractions-from-an-existing-search/m-p/228413#M67530 splunkto 2017-01-12T21:14:17Z