Splunk Search

Index time field extraction from another field

rahiparikh
Explorer

Hi,

I have two fields. Let's say they are field1 and field2. I extract field2 from field1. I also remove some part of field1 to give it appropriate value. Now, if I don't correct value of field1, I get field2. But, if I don't correct field1, I don't get field2 at all.

[transforms.conf]

[autocorrect_field1]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2>)(<regex3>)
DEST_KEY = field1
WRITE_META = true
FORMAT = field1::$1$3

[extract_field2]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2.1>)(<regex2.2>)(<regex3>)
DEST_KEY = field2
FORMAT = field2::$2
WRITE_META = true

I have also set 101 priority for field2 in props.conf. What is the issue?

Thanks!

0 Karma

woodcock
Esteemed Legend

Your props.conf needs to specify them in the correct order like this:

TRANSFORMS-correct = autocorrect_field1, extract_field2

Instead of what you are currently doing:

TRANSFORMS-wrong= extract_field2, autocorrect_field1
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...