Splunk Search

How to extract fields from a specific field instead of raw data using the conf files?

rsimmons
Splunk Employee
Splunk Employee

How to extract fields from a specific field instead of raw data using the conf files? Can it be done with EXTRACT-<class> = [<regex>|<regex> in <src_field>] in props.conf?

0 Karma

gcato
Contributor

Hi rsimmons,

Looks like this has already been answered here: https://answers.splunk.com/answers/47982/extracting-field-from-a-field-other-than-raw-in-props-conf....

You need to use transforms configuration instead.

Hope this helps.

0 Karma

rsimmons
Splunk Employee
Splunk Employee

The extract fields command only works on raw data with transforms.conf however not with index data. The extractions is done via kv_mode=auto for the fields.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...