Not working......
I'm testing field extractions on some new logs. I created simple regex to extract server names from the logs, and used REPORTS in transforms. The field extraction is not working at search time. validated with rex.
| rex field=_raw "(?<servername> [a-z][a-z]-[a-z][a-z][a-z][0-9][0-9])"
-rw------- 1 root root 75 Apr 12 20:51 props.conf
-rw-r--r-- 1 root root 111 Apr 12 19:50 transforms.conf
[root@id-spk01 local]# pwd
/opt/splunk/etc/system/local
--------------------------------
#props
[sourcetype::CoreLogs]
REPORT-servername = core_server_name
#transforms
[core_server_name]
REGEX = ([a-z][a-z]-[a-z][a-z][a-z][0-9][0-9])
FORMAT = core_server_name::"$1"
You shouldn't have
[sourcetype::whatever]
but just
[whatever]
Also, omit the quotes from around $1
, i.e. fieldname::$1
instead of fieldname::"$1"
.
You shouldn't have
[sourcetype::whatever]
but just
[whatever]
Also, omit the quotes from around $1
, i.e. fieldname::$1
instead of fieldname::"$1"
.
IN addition, your rex command is trying to capture a space, while your extraction is not trying to capture a space. I'm not sure if you want one or not. If you do, that would probably be REGEX = \s([a-z][a-z]-[a-z][a-z][a-z][0-9][0-9])