Splunk Search
Highlighted

Issue with extracting multifield values due to props.conf transform.conf settings

Builder

Hi Experts,

I am trying to extract something like below
type=type1,type3

My Data
event1.epochtime=1282182111 type=type1 value=value1 type=type3 value=value3

props.conf
[test]
REPORT-type = mv-type

transform.conf
[mv-type]
REGEX = type=(?type\s+)

MV_ADD = true

Now when I restart after above , I still see only one value in type, so result is type=type1 only . May I know what I am doing wrong ?

Regards
VG

0 Karma
Highlighted

Re: Issue with extracting multifield values due to props.conf transform.conf settings

Builder

I am taking help from below doc and using same example from here
http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Exampleconfigurationsusingfieldtransforms

0 Karma
Highlighted

Re: Issue with extracting multifield values due to props.conf transform.conf settings

SplunkTrust
SplunkTrust

Use captital S in your REGEX instead of small case.

REGEX = type=(?<type>\S+)

See the comment from @Daljeanis at the bottom on the documentation.

0 Karma
Highlighted

Re: Issue with extracting multifield values due to props.conf transform.conf settings

Builder

Thanks mate I should have seen this before ..lolz it works

0 Karma
Highlighted

Re: Issue with extracting multifield values due to props.conf transform.conf settings

SplunkTrust
SplunkTrust

Hi

Can you please try below configuration?

props.conf

[test]
REPORT-type = mv-type

transform.conf

[mv-type]
REGEX = type=(?<type>[^\s+]*)
MV_ADD = true

Thanks

View solution in original post

0 Karma
Highlighted

Re: Issue with extracting multifield values due to props.conf transform.conf settings

Builder

Well it works , I should have seen the comment which was mentioned at the below of the document . So it was the regex problem . Thanks for your response man

0 Karma