Splunk Search

Extracting Field from a Field other than _raw in props.conf

Dark_Ichigo
Builder

I want to add a Field Extractor Regex in props.conf but not from _raw but from another field

Example: rex Filed=test "(<BLA>\w+\w+)" I want to add this to props.conf but it thinks its extracting it from _raw and I want it to be extracted from test

How cant his be done?

1 Solution

dshpritz
SplunkTrust
SplunkTrust

This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf

[mysourcetype]

REPORT-myextract = myextract

Then in transforms.conf:

[myextract]

SOURCE_KEY = test

REGEX = (\w+\w+)

Dave

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf

[mysourcetype]

REPORT-myextract = myextract

Then in transforms.conf:

[myextract]

SOURCE_KEY = test

REGEX = (\w+\w+)

Dave

View solution in original post

Dark_Ichigo
Builder

Spot On! Thanks mate

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.