Splunk Search

Index time field extraction from another field

rahiparikh
Explorer

Hi,

I have two fields. Let's say they are field1 and field2. I extract field2 from field1. I also remove some part of field1 to give it appropriate value. Now, if I don't correct value of field1, I get field2. But, if I don't correct field1, I don't get field2 at all.

[transforms.conf]

[autocorrect_field1]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2>)(<regex3>)
DEST_KEY = field1
WRITE_META = true
FORMAT = field1::$1$3

[extract_field2]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2.1>)(<regex2.2>)(<regex3>)
DEST_KEY = field2
FORMAT = field2::$2
WRITE_META = true

I have also set 101 priority for field2 in props.conf. What is the issue?

Thanks!

0 Karma

woodcock
Esteemed Legend

Your props.conf needs to specify them in the correct order like this:

TRANSFORMS-correct = autocorrect_field1, extract_field2

Instead of what you are currently doing:

TRANSFORMS-wrong= extract_field2, autocorrect_field1
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...