Unable to extract fields from source

[siddharthmis]

I have props.conf defined as-

[source::C:\Web\...\...\Web\log\mobile.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

[source::C:\Web\...\...\Web\log\web.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

I am still unable to index the two fields. What am I doing wrong?
Do I need to make some other changes?

[DavidHourani]

Hello Siddharthmis,

Your problem is not in the regex, it is in the stanza.

the stanzas should look like this :

 [source::C:\Web\*\*\Web\log\mobile.log]
 EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

 [source::C:\Web\*\*\Web\log\web.log]
 EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

please refer to the following question for more details:
https://answers.splunk.com/answers/31643/using-source-for-field-extraction-in-props-conf.html

Regards,
David

[siddharthmis]

Thanks, it worked.

[<SOURCETYPEHERE>]
  EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

[<SOURCETYPEHERE>]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source

I used the above, though.

[DavidHourani]

Great! Please accept and up vote answer 🙂

[p_gurav]

Hi siddharthmis,

you can try rex command on source field:
| rex field=source "\w+:\\w+\(?P\w*)\(?P\w*)\.*"

[abhijeet01]

Hi @siddharthmis

can you please share your source string