How to make a "rex" search a permanent field extraction in props.conf and transforms.conf?

[changux]

Hi all,

I have this expression to extract the character part of one string:

... | rex field=Equipment "^(?<TEST>^[a-zA-Z]+)"

The field Equipment has content like MC01. I need the character part, in this case: MC and with the above search, it works like a charm.

To make this field extraction permanent, i tried:

My props.conf

[sourcetype1]
...
REPORT-test = TEST

And in transforms.conf:

[TEST]
SOURCE_KEY = Equipment
REGEX = ^(?<TEST>[\d+$])

But doesn't work (i can't see the new field in a search after restarting Splunk). I think that inside transforms.conf the regular expression must be different (i don't know) because when i remove the ^ at beginning of regex (to do a test), I can see the field in search with 0 and 1 values.

Any suggestion?

[gokadroid · Accepted solution]

If the field to be caught is like MC out of MC01 your current regex REGEX = ^(?<TEST>[\d+$]) is not going to catch it. It is saying catch anything which starts with either a digit, plus sign or dollar sign and catch only one charater Please use below regex:

REGEX = ^([A-Z][A-Z]) which will strictly catch it.
OR
REGEX = ^(.{2}) which will catch the first two characters whatever it is

[changux]

You right! My mistake. How i can capture the number part of the Equipment field?

[gokadroid]

you can try the following:
REGEX = .*(\d{2})