Splunk Search

Why is my current props and transforms configuration not extracting a multivalue field properly?

edrivera3
Builder

Hi
I don't know what I am doing wrong. I am try to extract a multivalue field, error_num. I tested it in the search app and it worked correctly. This is what I got:

props.conf:

[JobEventLog]
TRANSFORMS-error_num = mvfield_error_num

transforms.conf:

[mvfield_error_num]
 SOURCE_KEY = _raw
 REGEX = ERROR_:(?<error_num>d{5})
 MV_ADD = true
1 Solution

acharlieh
Influencer

Are you wanting to do this extraction at search time (which is most common) or index time? Your transforms.conf stanza looks like a search time extraction however your props.conf is referring to it as an index_time configuration. (Search time uses REPORT-name index time uses TRANSFORMS-name)

View solution in original post

acharlieh
Influencer

Are you wanting to do this extraction at search time (which is most common) or index time? Your transforms.conf stanza looks like a search time extraction however your props.conf is referring to it as an index_time configuration. (Search time uses REPORT-name index time uses TRANSFORMS-name)

edrivera3
Builder

Thank you acharlieh. I want to do the extraction at search time. I changed the props.conf to "REPORT" and it is working correctly now. Thank you.

acharlieh
Influencer

Glad to hear it helped! Converted my comment to an answer so it can be accepted.

0 Karma

woodcock
Esteemed Legend

Are your permissions correct (is it private to another user than the one searching)?

0 Karma

edrivera3
Builder

There is an underscore before "raw" but it doesn't show.

0 Karma

ppablo
Retired

Just edited it for ya @edrivera3. I usually highlight config stanzas and click on the "Code Sample" button in the editor to render special characters properly for regex.

Also, you should include some sample data for users to better help you out, especially when it comes to regex and field extraction related questions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...