Splunk Search

extract field from MetaData:Source

schose
Builder

Hi all,

I'm trying to extract the field "vservice" from Source as the last two characters (after _) from sourcetype "catalina".

props.conf

[catalina]
REPORT-vservice=vservice

transforms.conf

[vservice]
REGEX=_(\w\w)$
FORMAT=vservice::$1
SOURCE_KEY=MetaData:Source

I don't see why it's not working... 😞

index="myindex" | rex field=source _(?<vservice>\w\w)$ 

which should be the same is working fine for me.

Regards,

Andreas

1 Solution

schose
Builder

hi,

placing

SOURCE_KEY=MetaData:Source with
SOURCE_KEY=source

in transforms.conf seems to work.

Regards,

Andreas

View solution in original post

schose
Builder

hi,

placing

SOURCE_KEY=MetaData:Source with
SOURCE_KEY=source

in transforms.conf seems to work.

Regards,

Andreas

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...