Knowledge Management

Field extraction not working with transforms and props

lclayton95
Loves-to-Learn Lots

I am trying to extract some field values that comes in the following format

<date>00-mon-year</date>
<DisplayName>example</DisplayName>

<Hostname>example</Hostname>

 

When using the spl rex function i am able to extract the fields using 

rex field=_raw "Hostname>(?<hostname>.*)<".

 

Then i have tried to use both a inline regex function in props with the same regex (without quotes) and it does not work. I have also used a transforms.conf with the stanza as follows

[hostname]

FORMAT = Hostname::$1

REGEX =  Hostname>(?<hostname>(.*?))</Hostname

 

then in the props

REPORT -Hostname = hostname

 

and this does not work.

 

However, i have another source that pulls the same type of logs and i am able to use inline regex in spl format just fine with no issues. This issue is only specific to this source which i have as

[source::/opt/*]

 

Any ideas on this fix?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's best to put sample data and configs in code blocks so the formatting is retained.

You say you tried an inline regex in props.   Would you please share that?  The transform shared looks like it should have worked.  Please confirm the sourcetype in inputs.conf matches that in props.conf.

You have a source that works - how does that working config differ from the non-working one?  Please share the complete stanzas so we can spot any differences.

---
If this reply helps you, Karma would be appreciated.
0 Karma

lclayton95
Loves-to-Learn Lots

In my indexes.conf there isn't a stanza specified for source type the lines i have are

[example]

coldPath

coldToFrozenDir

enableDataIntergrity

homePath

thawedpath

 

The index in the props.conf that works is

 

[source::C:\\examplelogs*]

EXTRACT-logs = Hostname>(?<hostname>(.*?))</Hostname
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sourcetypes should match between inputs.conf and props.conf, except when props are specified for hosts or sources rather than sourcetypes.  The indexes.conf file does not use sourcetypes.

The regex needs an escape character before the /.  Also, the expression has two capture groups so make sure $1 is the group you expect.  Or use a single group.

Hostname>(?<hostname>.*?)<\/Hostname
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...