How to extract field values from another field using transforms.conf and props.conf?

[edrivera3]

Hi
I am trying to extract the field "block_num" from the field "block" during search-time. I've already extracted the field "block" correctly. I also tried this block_num extraction in the search app and it worked correctly. This is what I got:

transforms.conf:
[mvfield_block_num]
REGEX = Start-End\sSteps:\s(?<block_num>\d+-\d+)
SOURCE_KEY = fields:block
MV_ADD = true

props.conf
[tirfiles]
REPORT-block_num = mvfield_block_num

[jacobwilkins · Accepted solution]

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

[edrivera3]

Ok.
Block is a multi-value field and it is extracted in search-time:

[tirfiles]
REPORT-step_block = mvfield_step_block

[mvfield_step_block]
REGEX = ---\n(?<block>Block\sStatus[\w\W\n]{1,20000}?)----\n
MV_ADD = true

[edrivera3]

I changed props.conf to REPORT-step_block = mvfield_step_block, mvfield_block_num and it worked correctly. Thank you.

[edrivera3]

I forgot to mention that "block" is a multi value field.

[woodcock]

Use this instead:

SOURCE_KEY = block

[edrivera3]

I tried it, but it doesn't extract anything.

[woodcock]

There is nothing more to say unless you post sample events.