Field extraction not working with transforms and props

[lclayton95]

I am trying to extract some field values that comes in the following format

<date>00-mon-year</date>
<DisplayName>example</DisplayName>

<Hostname>example</Hostname>

When using the spl rex function i am able to extract the fields using 

rex field=_raw "Hostname>(?<hostname>.*)<".

Then i have tried to use both a inline regex function in props with the same regex (without quotes) and it does not work. I have also used a transforms.conf with the stanza as follows

[hostname]

FORMAT = Hostname::$1

REGEX =  Hostname>(?<hostname>(.*?))</Hostname

then in the props

REPORT -Hostname = hostname

and this does not work.

However, i have another source that pulls the same type of logs and i am able to use inline regex in spl format just fine with no issues. This issue is only specific to this source which i have as

[source::/opt/*]

Any ideas on this fix?

[richgalloway]

It's best to put sample data and configs in code blocks so the formatting is retained.

You say you tried an inline regex in props.   Would you please share that?  The transform shared looks like it should have worked.  Please confirm the sourcetype in inputs.conf matches that in props.conf.

You have a source that works - how does that working config differ from the non-working one?  Please share the complete stanzas so we can spot any differences.

[lclayton95]

In my indexes.conf there isn't a stanza specified for source type the lines i have are

[example]

coldPath

coldToFrozenDir

enableDataIntergrity

homePath

thawedpath

The index in the props.conf that works is

[source::C:\\examplelogs*]

EXTRACT-logs = Hostname>(?<hostname>(.*?))</Hostname

[richgalloway]

Sourcetypes should match between inputs.conf and props.conf, except when props are specified for hosts or sources rather than sourcetypes.  The indexes.conf file does not use sourcetypes.

The regex needs an escape character before the /.  Also, the expression has two capture groups so make sure $1 is the group you expect.  Or use a single group.

Hostname>(?<hostname>.*?)<\/Hostname