Splunk Search

Unable to extract fields from source

siddharthmis
Explorer

I have props.conf defined as-

[source::C:\Web\...\...\Web\log\mobile.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

[source::C:\Web\...\...\Web\log\web.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

I am still unable to index the two fields. What am I doing wrong?
Do I need to make some other changes?

Tags (1)
0 Karma

DavidHourani
Super Champion

Hello Siddharthmis,

Your problem is not in the regex, it is in the stanza.

the stanzas should look like this :

 [source::C:\Web\*\*\Web\log\mobile.log]
 EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

 [source::C:\Web\*\*\Web\log\web.log]
 EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

please refer to the following question for more details:
https://answers.splunk.com/answers/31643/using-source-for-field-extraction-in-props-conf.html

Regards,
David

0 Karma

siddharthmis
Explorer

Thanks, it worked.

[<SOURCETYPEHERE>]
  EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

[<SOURCETYPEHERE>]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

I used the above, though.

0 Karma

DavidHourani
Super Champion

Great! Please accept and up vote answer :slightly_smiling_face:

0 Karma

p_gurav
Champion

Hi siddharthmis,

you can try rex command on source field:
| rex field=source "\w+:\\w+\(?P\w*)\(?P\w*)\.*"

0 Karma

abhijeet01
Path Finder

Hi @siddharthmis

can you please share your source string

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...