Splunk Search

Extracting Field from a Field other than _raw in props.conf

Dark_Ichigo
Builder

I want to add a Field Extractor Regex in props.conf but not from _raw but from another field

Example: rex Filed=test "(<BLA>\w+\w+)" I want to add this to props.conf but it thinks its extracting it from _raw and I want it to be extracted from test

How cant his be done?

1 Solution

dshpritz
SplunkTrust
SplunkTrust

This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf

[mysourcetype]

REPORT-myextract = myextract

Then in transforms.conf:

[myextract]

SOURCE_KEY = test

REGEX = (\w+\w+)

Dave

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf

[mysourcetype]

REPORT-myextract = myextract

Then in transforms.conf:

[myextract]

SOURCE_KEY = test

REGEX = (\w+\w+)

Dave

View solution in original post

Dark_Ichigo
Builder

Spot On! Thanks mate

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!