Field Extraction from Indexed field

[Poojitha]

Hi All,

I am trying to extract a value from the indexed field. i.e from source field . I have added the regex in props.conf 

Example : 

source  = 234234324234:us-west-2:firehose_list_tags_for_resource

I want everything after second : (colon) as service i.e firehose_list_tags_for_resource

I have added in props.conf as below :

EXTRACT-service = source([^:]+:[^:]+:(?<service>.+)$)

This has created the field service but fetching wrong value. It is fetching last part of raw data.

Please can anyone help me to understand how can I extract field value from indexed data ? Should I add in transforms.conf as well ?

Please can anyone guide me. It helps me lot

Regards,
PNV

[richgalloway]

Tell Splunk which field to extract from by using the in option.

EXTRACT-service = [^:]+:[^:]+:(?<service>.+)$ in source

[deepakc]

Use the below as an example, using both props and transforms,  change to your sourcetype that you are using and if it works, change your group names if desired. 

Props.conf
[my_sourcetype]
REPORT-my_service = extract_service

Transforms.conf
[extract_service]
SOURCE_KEY = source
REGEX = [^:]+:(?<my_service>.+)$
FORMAT = my_service::$1

[gcusello]

Hi @Poojitha,

please try this:

| rex field=source ":(?<your_field>\w+)$"

or in props.conf:

EXTRACT-service = EXTRACT-service = source([^:]+:[^:]+:(?<service>.+)$) in source

that you can test at https://regex101.com/r/NBjX8h/1

ciao.

Giuseppe