Field extraction and Splunk forwarding

[lrhazi]

I have systems sending data to splunk1 in the form: k1=v1 k2=v2
I have field extraction configured for the sourcetype,to extract those fields as name1 and name2. This works fine.
I have another system sending similar data to splunk2, which is configured to route it, based our "source" to splunk1.

the data from this remote system, though it has the correct sourcetype, does not get my custom field extraction applied, instead I get the automatic fields extracted with thier short names, k1, k2.

I tried adding my extraction rules to props/transforms on splunk2, in addition to splunk1, but to no avail. How can I fix this?

[lguinn2]

Are your field extractions search-time or index-time? They should be search-time. Can you post your props.conf and transforms.conf so we can see them?

If your field extractions are index-time, they will not apply retroactively to data that has already been indexed. (One of the several disadvantages of index-time fields.) Search-time field extractions apply to all data, regardless of when it was indexed.

If you aren't sure whether your field extractions are search-time or index-time, check out the links below. Also, we will be able to tell once we see the .conf files.
Useful links:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Indextimeversussearchtime

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac...

[lguinn2]

Glad it worked. This is search-time field extraction BTW.

[lrhazi]

Thanks a lot for the links... which lead me to "Field aliasing", which is really all I needed, Splunk already parses and extract my fields correctly, just needed them renamed, and aliasing seems to work just fine too!

[lrhazi]

Thanks a alot.. My extractions are like what follows.. I guess index-time?

props.conf:

[bigip-syslog]
REPORT-gtm-dns-fields = gtm-dns-fields-1

transforms.conf:
[gtm-dns-fields-1]
REGEX = v=([\d.]+):? c=([\d.]+)
FORMAT = vip::$1 client::$2