Splunk Search

REGEX not working in transforms.conf

jhallur_splunk
Splunk Employee
Splunk Employee

Here is my event:

Contact=" (Contact){ Id -- '123' Email -- 'johnny@gmail.com' Name -- 'Johnny blah' Phone -- '3333337856' }”

my props.conf

[ST_CONTACT_INFO]
BREAK_ONLY_BEFORE = Contact=
MAX_TIMESTAMP_LOOKAHEAD = 150
REPORT-contact1 = report-contactdetails
NO_BINARY_CHECK = 1
pulldown_type = 1

my transforms.conf

[report-contactdetails]
SOURCE_KEY = Contact
REGEX = [\s]([\w]+)[\s]--[\s]\'([^\']+)
FORMAT = $1::$2
MV_ADD = true

The fields like Id , Email, Name and Phone numbers are not auto extracted. The REGEX works fine and tested on regex101.com , check at http://regex101.com/r/tP2wB5/2
When I put the configuration in props.conf and transforms.conf, why it is not working? I have ensured that I gave the correct SOURCETYPE for the input.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

So it seems the field Contact isn't available at the time of that REPORT application.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Yup, done.

0 Karma

jhallur_splunk
Splunk Employee
Splunk Employee

Please put your answer in the answer text box below so that I can accept it.

martin_mueller
SplunkTrust
SplunkTrust

So it seems the field Contact isn't available at the time of that REPORT application.

jhallur_splunk
Splunk Employee
Splunk Employee

Yes, it worked, but this overwrites the originally auto extracted field "Contact" with value single quote only. i.e Contact="

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

To narrow possible causes down please comment out the SOURCE_KEY - your extraction should still match on the _raw text as shown by your URL.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...