Simple field extraction with data index from /var/spool/splunk

[tkropp]

Not working......

I'm testing field extractions on some new logs. I created simple regex to extract server names from the logs, and used REPORTS in transforms. The field extraction is not working at search time. validated with rex.

| rex field=_raw "(?<servername> [a-z][a-z]-[a-z][a-z][a-z][0-9][0-9])"


-rw------- 1 root   root    75 Apr 12 20:51 props.conf
-rw-r--r-- 1 root   root   111 Apr 12 19:50 transforms.conf
[root@id-spk01 local]# pwd
/opt/splunk/etc/system/local

--------------------------------
#props

[sourcetype::CoreLogs]
REPORT-servername = core_server_name

#transforms

[core_server_name]
REGEX = ([a-z][a-z]-[a-z][a-z][a-z][0-9][0-9])
FORMAT = core_server_name::"$1"

[gkanapathy · Accepted solution]

You shouldn't have

[sourcetype::whatever]

but just

[whatever]

Also, omit the quotes from around $1, i.e. fieldname::$1 instead of fieldname::"$1".

[jrodman]

IN addition, your rex command is trying to capture a space, while your extraction is not trying to capture a space. I'm not sure if you want one or not. If you do, that would probably be REGEX = \s([a-z][a-z]-[a-z][a-z][a-z][0-9][0-9])