Splunk Search

We have tried to extract index time field extarction

rvinil
New Member

We have tried to extract index time field extraction, below are the details..
props.conf:-

[sourcetype]
TRANSFORMS-fieldname = fieldname

Transforms.conf:-

[fieldname]
REGEX = regexquery
FORMAT = fieldname::"$1"
SOURCE_KEY = fieldname

fields.conf:-

[fieldname]
INDEXED = true

Thanks in advance

Tags (1)
0 Karma
1 Solution

micahkemp
Champion

You also need WRITE_META = true in your transform.

Also make sure your regex has a capturing group. Your format line says to use the first capture group as the field value.

View solution in original post

0 Karma

nkchaitanya
Explorer

try as

Transforms.conf
[fieldname]
REGEX =regex
FORMAT = fieldname::"$1"
SOURCE_KEY = fieldname
WRITE_META = true

in Props.conf
[sourcetype]
REPORT-fieldname = fieldname
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true

0 Karma

micahkemp
Champion

You also need WRITE_META = true in your transform.

Also make sure your regex has a capturing group. Your format line says to use the first capture group as the field value.

0 Karma

rvinil
New Member

Hi Micahkemp,

Used the write_meta = true. Its working in my PC, when i used the same ".conf's" in office not able to get the data. Please suggest...

0 Karma

micahkemp
Champion

Which instance did you install this configuration on? It needs to go on the heavy forwarders and indexers.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...