Field extraction windows sources

[Josh]

Hello All,

I am attempting to use props and tranforms to extract field values from the source field. the source is coming from a Windows machine. I am able to extract fields from source from Linux sources however doesnt seem to be working for me from Windows sources. I am guessing there is something wrong with the regex below, hoping someone can take a look.

From the below at search time I am expecting to see two fields avaialble: application=NetShimService port=9932

source:

C:\Program Files\DTS\remotelogging\logs\NetShimService\Logs\9932\BRAVO_TMS_DEV_MDS.log

tranforms.conf

[dtsAppName]
SOURCE_KEY = source
REGEX = C:\\\Program Files\\\DTS\\\remotelogging\\\logs\\\(?<application>.*)\\\Logs\\\?<port>[0-9].*\\\.*

props.conf

[applogs]
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = LOG_ENTRY
REPORT-dts = dtsAppName
TRANSFORMS-dtsremove = setNull

[gkanapathy · Accepted solution]

Your regex should be:

REGEX = (?i)C:\\Program Files\\DTS\\remotelogging\\logs\\(?<application>[^\\]*)\\Logs\\(?<port>\d*)\\

• You were missing parentheses around the port capture group.
• In regex, a \ (backslash) character should be escaped as \\ (two backslashes), not \\\ (three backslashes).
• Not absolutely required, but you should make the regex case-insensitive when comparing against Windows paths with (?i).

[zscgeek]

Not sure why but my regex test tools did not like your regex. Try this to see if it works:

tranforms.conf

[dtsAppName]
REGEX = C:\\Program Files\\DTS\\remotelogging\\....\\(?<application>.+?)\\.ogs\\(?<port>\d+)\\.*