Splunk Search

How to extract field values from another field using transforms.conf and props.conf?

edrivera3
Builder

Hi
I am trying to extract the field "block_num" from the field "block" during search-time. I've already extracted the field "block" correctly. I also tried this block_num extraction in the search app and it worked correctly. This is what I got:

transforms.conf:
[mvfield_block_num]
REGEX = Start-End\sSteps:\s(?<block_num>\d+-\d+)
SOURCE_KEY = fields:block
MV_ADD = true

props.conf
[tirfiles]
REPORT-block_num = mvfield_block_num

1 Solution

jacobwilkins
Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

View solution in original post

jacobwilkins
Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

edrivera3
Builder

Ok.
Block is a multi-value field and it is extracted in search-time:

[tirfiles]
REPORT-step_block = mvfield_step_block

[mvfield_step_block]
REGEX = ---\n(?<block>Block\sStatus[\w\W\n]{1,20000}?)----\n
MV_ADD = true

0 Karma

edrivera3
Builder

I changed props.conf to REPORT-step_block = mvfield_step_block, mvfield_block_num and it worked correctly. Thank you.

edrivera3
Builder

I forgot to mention that "block" is a multi value field.

0 Karma

woodcock
Esteemed Legend

Use this instead:

SOURCE_KEY = block
0 Karma

edrivera3
Builder

I tried it, but it doesn't extract anything.

0 Karma

woodcock
Esteemed Legend

There is nothing more to say unless you post sample events.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...