Splunk Search

How to make a "rex" search a permanent field extraction in props.conf and transforms.conf?

Builder

Hi all,

I have this expression to extract the character part of one string:

... | rex field=Equipment "^(?<TEST>^[a-zA-Z]+)"

The field Equipment has content like MC01. I need the character part, in this case: MC and with the above search, it works like a charm.

To make this field extraction permanent, i tried:

My props.conf

[sourcetype1]
...
REPORT-test = TEST

And in transforms.conf:

[TEST]
SOURCE_KEY = Equipment
REGEX = ^(?<TEST>[\d+$])

But doesn't work (i can't see the new field in a search after restarting Splunk). I think that inside transforms.conf the regular expression must be different (i don't know) because when i remove the ^ at beginning of regex (to do a test), I can see the field in search with 0 and 1 values.

Any suggestion?

0 Karma
1 Solution

Motivator

If the field to be caught is like MC out of MC01 your current regex REGEX = ^(?<TEST>[\d+$]) is not going to catch it. It is saying catch anything which starts with either a digit, plus sign or dollar sign and catch only one charater Please use below regex:

REGEX = ^([A-Z][A-Z]) which will strictly catch it.
OR
REGEX = ^(.{2}) which will catch the first two characters whatever it is

View solution in original post

0 Karma

Motivator

If the field to be caught is like MC out of MC01 your current regex REGEX = ^(?<TEST>[\d+$]) is not going to catch it. It is saying catch anything which starts with either a digit, plus sign or dollar sign and catch only one charater Please use below regex:

REGEX = ^([A-Z][A-Z]) which will strictly catch it.
OR
REGEX = ^(.{2}) which will catch the first two characters whatever it is

View solution in original post

0 Karma

Builder

You right! My mistake. How i can capture the number part of the Equipment field?

0 Karma

Motivator

you can try the following:
REGEX = .*(\d{2})

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!