Splunk Search

Which of these field extractions defined in props.conf will Splunk consider for this field?

Builder

I'd extracted 2 fields in props.conf as below:

[abc_xml_v1]
EXTRACT-abc_rac_cd_instance = ^/(cs|app)/abc/.*/adump/(?[^o][^_]+) in source
EXTRACT-abc_single_cd_instance = ^/(cs|app)/abc/(?[^/]+)/.*/adump/o in source

Which means I'd extracted two fields in a source with the same field name "cdinstance". In such cases, which extraction will Splunk consider for the field "cdinstance" ?

Any idea?

0 Karma
1 Solution

Communicator

Hi,

Splunk always processes the props.conf sequential. Which means if you define the same field in two or more Extractions it will always be the value of the last called EXTRACT in props.conf.

Just give me a feedback if this is what you wanted to know. Im not quite sure about.

View solution in original post

0 Karma

Communicator

Hi,

Splunk always processes the props.conf sequential. Which means if you define the same field in two or more Extractions it will always be the value of the last called EXTRACT in props.conf.

Just give me a feedback if this is what you wanted to know. Im not quite sure about.

View solution in original post

0 Karma