I am trying to extract some field values that comes in the following format
<date>00-mon-year</date>
<DisplayName>example</DisplayName>
<Hostname>example</Hostname>
When using the spl rex function i am able to extract the fields using
rex field=_raw "Hostname>(?<hostname>.*)<".
Then i have tried to use both a inline regex function in props with the same regex (without quotes) and it does not work. I have also used a transforms.conf with the stanza as follows
[hostname]
FORMAT = Hostname::$1
REGEX = Hostname>(?<hostname>(.*?))</Hostname
then in the props
REPORT -Hostname = hostname
and this does not work.
However, i have another source that pulls the same type of logs and i am able to use inline regex in spl format just fine with no issues. This issue is only specific to this source which i have as
[source::/opt/*]
Any ideas on this fix?
It's best to put sample data and configs in code blocks so the formatting is retained.
You say you tried an inline regex in props. Would you please share that? The transform shared looks like it should have worked. Please confirm the sourcetype in inputs.conf matches that in props.conf.
You have a source that works - how does that working config differ from the non-working one? Please share the complete stanzas so we can spot any differences.
In my indexes.conf there isn't a stanza specified for source type the lines i have are
[example]
coldPath
coldToFrozenDir
enableDataIntergrity
homePath
thawedpath
The index in the props.conf that works is
[source::C:\\examplelogs*]
EXTRACT-logs = Hostname>(?<hostname>(.*?))</Hostname
Sourcetypes should match between inputs.conf and props.conf, except when props are specified for hosts or sources rather than sourcetypes. The indexes.conf file does not use sourcetypes.
The regex needs an escape character before the /. Also, the expression has two capture groups so make sure $1 is the group you expect. Or use a single group.
Hostname>(?<hostname>.*?)<\/Hostname