Why do my inline eval statements work with spath, but do not as calculated fields in props.conf?

[jwalthour]

Why does this work:

index=dns sourcetype=stream:dns
| eval host_addresses=spath(_raw,"host_addr{}")
| eval hostnames=spath(_raw,”hostname{}”)
| eval message_types=spath(_raw,"message_type{}")
| eval names=spath(_raw,"name{}")
| eval queries=spath(_raw,"query{}")
| eval query_types=spath(_raw,"query_type{}")
| eval ttls=spath(_raw,"ttl{}")

 but this does not in props.conf:

[stream:dns]
EXTRACT-host_addresses = spath(_raw,"host_addr{}")
EXTRACT-message_types = spath(_raw,"message_type{}")
EXTRACT-hostnames = spath(_raw,"hostname{}")
EXTRACT-names = spath(_raw,"name{}")
EXTRACT-queries = spath(_raw,"query{}")
EXTRACT-query_types = spath(_raw,"query_type{}")
EXTRACT-ttls = spath(_raw,"ttl{}")

[FrankVl · Accepted solution]

EXTRACT works with regex, not with spath. You could try with EVAL statements in your props.conf.

But it might make more sense to just apply something like KV_MODE = json in your props.conf. Or just get the splunk stream TA on your search heads, which should be able to handle all the field extraction stuff for such data I would say?