Splunk Search

Field extraction and Splunk forwarding

lrhazi
Path Finder

I have systems sending data to splunk1 in the form: k1=v1 k2=v2
I have field extraction configured for the sourcetype,to extract those fields as name1 and name2. This works fine.
I have another system sending similar data to splunk2, which is configured to route it, based our "source" to splunk1.

the data from this remote system, though it has the correct sourcetype, does not get my custom field extraction applied, instead I get the automatic fields extracted with thier short names, k1, k2.

I tried adding my extraction rules to props/transforms on splunk2, in addition to splunk1, but to no avail. How can I fix this?

Tags (1)
0 Karma

lguinn2
Legend

Are your field extractions search-time or index-time? They should be search-time. Can you post your props.conf and transforms.conf so we can see them?

If your field extractions are index-time, they will not apply retroactively to data that has already been indexed. (One of the several disadvantages of index-time fields.) Search-time field extractions apply to all data, regardless of when it was indexed.

If you aren't sure whether your field extractions are search-time or index-time, check out the links below. Also, we will be able to tell once we see the .conf files.
Useful links:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Indextimeversussearchtime

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac...

0 Karma

lguinn2
Legend

Glad it worked. This is search-time field extraction BTW.

0 Karma

lrhazi
Path Finder

Thanks a lot for the links... which lead me to "Field aliasing", which is really all I needed, Splunk already parses and extract my fields correctly, just needed them renamed, and aliasing seems to work just fine too!

lrhazi
Path Finder

Thanks a alot.. My extractions are like what follows.. I guess index-time?

props.conf:

[bigip-syslog]
REPORT-gtm-dns-fields = gtm-dns-fields-1

transforms.conf:
[gtm-dns-fields-1]
REGEX = v=([\d.]+):? c=([\d.]+)
FORMAT = vip::$1 client::$2

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...