Getting Data In

How to EXTRACT regex expression in props.conf?

greggz
Communicator

I have this file with this appearance

first.prop.one=1
first.prop.two=2
first.prop.third=3

I was using KV_MODE=Auto, but I need more than 100 results. So I went to the HF, in the sourcetype definitions added

[sourcetype]
EXTRACT-Property=(?<Property>.+)=(?<Value>.+)

But nothing changed. Am I extracting correctly ?

thanks

0 Karma

micahkemp
Champion

EXTRACT and REPORT are search time objects, and need to be in place on the search head (not the forwarder).

I'd also suggest setting KV_MODE = none to avoid potential conflicts.

greggz
Communicator

Ohhh right. Anyway, is the regex correct ?

0 Karma

DUThibault
Contributor

It looks okay, but just to be sure I'd write it as (?<Property>[^=]+)=(?<Value>.+)


Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on