Field Extraction with transforms configuration

[SplunkDash]

Hello,

I have issues getting expected field value pairs using following props and transforms configuration files. Sample events and my configuration files are given below. Any recommendation will be highly appreciated.

My Configuration Files

[mypropsfile]

REPORT-mytranforms=myTransfile

[myTransfile]
REGEX = ([^"]+?):\s+([^"]+?)
FORMAT = $1::$2

Sample Events

2023-11-15T18:56:30.098Z, User ID: 90A, User Type: TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:29.098Z, User ID: 90A, Host:  vx2tbax.dev, User Type: TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:28.098Z, User ID: 91B, User Type:  TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:27.098Z, User ID: 91B, User Type:  TempEMP,  Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244

2023-11-15T18:56:27.001Z, User ID: 91B, User Type:  TempEMP,  Host:  vx2tbax.dev, Product Code:  pc, UAT:  UTA-True, Event Type:  TEST,  EventID:  Lookup, Remote Host: 25.191.157.244

[dtburrows3 · Accepted solution]

First glance it looks like this the regex you provided is looking for double quote to help find the pattern and the sample event don't seem to have any.

I think you may have better luck using a regex closer to


REGEX = \s+([^:]+?):\s+([^,]+)

I havent tested locally but on regex 101 it looks like it matches pretty well

[SplunkDash]

Hello @dtburrows3,

Thank you so much for your quick response, truly appreciate it. I am getting this: