Splunk Search

How to extract field values from another field using transforms.conf and props.conf?

Builder

Hi
I am trying to extract the field "block_num" from the field "block" during search-time. I've already extracted the field "block" correctly. I also tried this block_num extraction in the search app and it worked correctly. This is what I got:

transforms.conf:
[mvfield_block_num]
REGEX = Start-End\sSteps:\s(?<block_num>\d+-\d+)
SOURCE_KEY = fields:block
MV_ADD = true

props.conf
[tirfiles]
REPORT-block_num = mvfield_block_num

1 Solution

Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

View solution in original post

Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

View solution in original post

Builder

Ok.
Block is a multi-value field and it is extracted in search-time:

[tirfiles]
REPORT-step_block = mvfield_step_block

[mvfield_step_block]
REGEX = ---\n(?<block>Block\sStatus[\w\W\n]{1,20000}?)----\n
MV_ADD = true

0 Karma

Builder

I changed props.conf to REPORT-step_block = mvfield_step_block, mvfield_block_num and it worked correctly. Thank you.

Builder

I forgot to mention that "block" is a multi value field.

0 Karma

Esteemed Legend

Use this instead:

SOURCE_KEY = block
0 Karma

Builder

I tried it, but it doesn't extract anything.

0 Karma

Esteemed Legend

There is nothing more to say unless you post sample events.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!