Splunk Search

Props and Transforms report field extractions not working

dflodstrom
Builder

I am trying to configure props/transforms in a custom TA to perform some search-time field extractions for a custom event source. I have no issues creating the REGEX extraction in props.conf but when I try to use my REGEX as a report in transforms I don't have any luck.

in metadata/default.meta I have this:

 []
    access = read : [ * ], write : [ admin ]
    export = system

In props.conf I have:

  [sourcetype]
    REPORT-fields = fields_extract

In transforms.conf I have:

 [fields_extract]
    REGEX = regex(?<field1>\S+)\s(?<field2>\S+)

Background: I need to extract and name the fields for this sourcetype. Some events which describe errors contain fields within the data that don't exist in other events. My plan is to have one regex that works on every event and another regex that matches starting on the error description to pull out the extra fields. I understand how to call two reports on one line but for some reason I can't get my extraction to work in transforms, only in props.

0 Karma

dflodstrom
Builder

Mods can close this question. The solution wasn't Splunk related. I've awarded points to @rsennett_splunk for contributing.

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

You probably want to add the FORMAT to our transforms stanza, and your syntax for the regex is odd... unless your data really is prefixed by the characters r e g e x that's what you're telling it.

Since you seem to have values and no keys it would look like this:

[fields_extract]
REGEX=(?<field1>\S+)\s(?<field2>\S+)
FORMAT = first_Field::$1 second_Field::$2
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

dflodstrom
Builder

I should have mentioned that my 'regex' was only to use as an example. I have an actual regex string in there that worked just fine when I had it in props.conf.

I thought my syntax of (?) meant that I didn't have to use the FORMAT parameter. I will give this a try and get right back!

0 Karma

landen99
Motivator

You don't need FORMAT when you use

(?<myfield>.)
0 Karma

dflodstrom
Builder

My solution was a sad case of fat fingers. Thanks @rsennett_splunk for having a look. I've sent you 10 points.

rsennett_splunk
Splunk Employee
Splunk Employee

Ha. awesome. thank you!

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...