Splunk Search
Highlighted

How to extract field values from another field using transforms.conf and props.conf?

Builder

Hi
I am trying to extract the field "blocknum" from the field "block" during search-time. I've already extracted the field "block" correctly. I also tried this blocknum extraction in the search app and it worked correctly. This is what I got:

transforms.conf:
[mvfieldblocknum]
REGEX = Start-End\sSteps:\s(?<blocknum>\d+-\d+)
SOURCE
KEY = fields:block
MV_ADD = true

props.conf
[tirfiles]
REPORT-blocknum = mvfieldblock_num

Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Esteemed Legend

Use this instead:

SOURCE_KEY = block
0 Karma
Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Builder

I tried it, but it doesn't extract anything.

0 Karma
Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Esteemed Legend

There is nothing more to say unless you post sample events.

0 Karma
Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Builder

I forgot to mention that "block" is a multi value field.

0 Karma
Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extractblock, mvfieldblock_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

View solution in original post

Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Builder

Ok.
Block is a multi-value field and it is extracted in search-time:

[tirfiles]
REPORT-stepblock = mvfieldstep_block

[mvfieldstepblock]
REGEX = ---\n(?<block>Block\sStatus[\w\W\n]{1,20000}?)----\n
MV_ADD = true

0 Karma
Highlighted

Re: How to extract field values from another field using transforms.conf and props.conf?

Builder

I changed props.conf to REPORT-stepblock = mvfieldstepblock, mvfieldblock_num and it worked correctly. Thank you.