We are trying to create an index time field extraction. I tried following the docs, but I am making a mistake somewhere.
It is working as a search time extraction, but we are running into performance issues/would like to use tsats without a datamodel.
The log line is:
Feb 21 20:28:22 server-name %PARSER-5-TESTLOG_LOGGEDCMD: User:unknown user logged command:!exec: enable
[sourcetype] TRANSFORMS-test = test
[test] REGEX = %(?\S+):\s(?[\S\s]+) WRITE_META = true
Is anyone able to point me into the right direction?
Thanks in advance!
I hope you're following this documentation.
So check these
1) ensure the regex is correct.
2) You need to have a name to the capturing group (name of the field). I don't see that in the config you posted in the question.
3) Add an entry in the fields.conf (see the documentation above).
4) Ensure that you're placing the config in correct Splunk server (heavy forwarder OR indexer whichever comes first on your data flow).
You don't necessarily need to have names for the capturing groups 😉
Try this in your
[test] REGEX = %(\S+):\s([\S\s]+) FORMAT = $1::$2 WRITE_META = true
Put it on the parsing instance and restart Splunk.
Hope this helps ...
PS: don't forget to add
fields.conf on your SH like @somesoni2 mentioned