Splunk Search

Index time field extraction from another field

rahiparikh
Explorer

Hi,

I have two fields. Let's say they are field1 and field2. I extract field2 from field1. I also remove some part of field1 to give it appropriate value. Now, if I don't correct value of field1, I get field2. But, if I don't correct field1, I don't get field2 at all.

[transforms.conf]

[autocorrect_field1]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2>)(<regex3>)
DEST_KEY = field1
WRITE_META = true
FORMAT = field1::$1$3

[extract_field2]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2.1>)(<regex2.2>)(<regex3>)
DEST_KEY = field2
FORMAT = field2::$2
WRITE_META = true

I have also set 101 priority for field2 in props.conf. What is the issue?

Thanks!

0 Karma

woodcock
Esteemed Legend

Your props.conf needs to specify them in the correct order like this:

TRANSFORMS-correct = autocorrect_field1, extract_field2

Instead of what you are currently doing:

TRANSFORMS-wrong= extract_field2, autocorrect_field1
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...