Why are my search time extractions not working?

[Fonzie2k]

Hi Splunkers,

Im having problems with the "EXTRACT" functions in props.conf.

Im trying to extract the fields from a log that is formatted like this (values are changed for privacy reasons):

DateTime: 2022-12-05T08:00:37

InterchangeId: asdf12-asdf12-asdf12-asdf12-asdf12

DocumentId:

Sender: foobar

Receiver: barfoo

MessageType: foo

RequesterId: bar

Status: Running

Filename: file.json

DateTime: 2022-12-05T08:00:37

InterchangeId: asdf12-asdf12-asdf12-asdf12-asdf12

DocumentId:

Sender: foobar

Receiver: barfoo

MessageType: foo

RequesterId: bar

Status: Running

Filename: file.json

I uploaded this data into Splunk, and i wrote the regexes that extracts the value.

This search works perfectly:

index=* sourcetype=test-sourcetype

| rex "InterchangeId:\s(?<InterchangeId>[^\n\r]+)"

| rex "DocumentId:\s(?<DocumentId>[^\n\r]+)"

| rex "Sender:\s(?<Sender>[^\n\r]+)"

| rex "Receiver:\s(?<Receiver>[^\n\r]+)"

| rex "MessageType:\s(?<MessageType>[^\n\r]+)"

| rex "Status:\s(?<Status>[^\n\r]+)"

| rex "Filename:\s(?<Filename>[^\n\r]+)"

| rex "RequesterName:\s(?<RequesterName>[^\n\r]+)"

However, when i try to implement this using the "EXTRACT" config in props.conf, it does not work:

[test-sourcetype]

EXTRACT-InterchangeId = InterchangeId:\s(?<InterchangeId>[^\n\r]+)

EXTRACT-DocumentId = DocumentId:\s(?<DocumentId>[^\n\r]+)

EXTRACT-Sender = Sender:\s(?<Sender>[^\n\r]+)

EXTRACT-Receiver = Receiver:\s(?<Receiver>[^\n\r]+)

EXTRACT-MessageType = MessageType:\s(?<MessageType>[^\n\r]+)

EXTRACT-Status = Status:\s(?<Status>[^\n\r]+)

EXTRACT-Filename = Filename:\s(?<Filename>[^\n\r]+)

EXTRACT-RequesterName = RequesterName:\s(?<RequesterName>[^\n\r]+)

I have used btool to verify this is picked up on the search head.

I can also see this config in the GUI: "Settings" -> "fields"

I have tried applying "KV_MODE = none" aswell, without any difference.

And yes, this code is deployed to an app on a Search head, since its an search time extraction.

I've tried with many different regex'es, to debug if that is the problem, but without any luck.

Does anyone have any idea on what im doing wrong here?

[Fonzie2k · Accepted solution]

It seems like the problem was that the setting "export = system" in the file ../appname/metadata/default.meta was missing. After adding that, the search time extration works.