- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
EXTRACT-field command is not working in Splunk cloud for props.conf file
I am trying to add an EXTRACT-field command in Splunk cloud. I added the regex, it is working in search and capturing the value. But the field is not populating when applied to the props.conf file. The value I want to extract is "Stage=number". The regex I created is:
EXTRACT-Stage = Stage=(?<Stage>\d+)
What could be the reason?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sample logs looks like this:
adshdsfkdlfpofgsk message hdksodb Stage=8 gjhjyeomhf hjhdgy …
I deployed the configurations in the cloud instance from the settings > sourcetypes option.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First, Key value pairs (field=value) are usually auto extracted when KV_MODE is set to auto in props.conf.
Configure automatic key-value field extraction - Splunk Documentation
If it is set to none please set your field extraction under Settings --> Fields --> Field extractions that's the right place for it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please share some sample data and explain how and where you configured the props.conf.
