We have tried to extract index time field extarction

[rvinil]

We have tried to extract index time field extraction, below are the details..
props.conf:-

[sourcetype]
TRANSFORMS-fieldname = fieldname

Transforms.conf:-

[fieldname]
REGEX = regexquery
FORMAT = fieldname::"$1"
SOURCE_KEY = fieldname

fields.conf:-

[fieldname]
INDEXED = true

Thanks in advance

[nkchaitanya]

try as

Transforms.conf
[fieldname]
REGEX =regex
FORMAT = fieldname::"$1"
SOURCE_KEY = fieldname
WRITE_META = true

in Props.conf
[sourcetype]
REPORT-fieldname = fieldname
NO_BINARY_CHECK = true
category = Custom
disabled = false
pulldown_type = true

[micahkemp · Accepted solution]

You also need WRITE_META = true in your transform.

Also make sure your regex has a capturing group. Your format line says to use the first capture group as the field value.

[rvinil]

Hi Micahkemp,

Used the write_meta = true. Its working in my PC, when i used the same ".conf's" in office not able to get the data. Please suggest...

[micahkemp]

Which instance did you install this configuration on? It needs to go on the heavy forwarders and indexers.