I am having issues doing search time extraction via REPORT- command in props and transforms.
Here is my code.
[mySourceType] SHOULD_LINEMERGE = false KV_MODE = none EXTRACT-myEventType = some regex which does work to extract one field REPORT-myDHCP = dhcpack_type1, dhcpack_type2
[dhcpack_type1] REGEX=\s(dhcpd).+]\:\s(DHCPACK)\son\s(\S+)\sto\s(\S+)\s(?:\(([^\)]+)\)\s)?via\s(\S+) FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 src_host::$5 dest_int::$6 [dhcpack_type2] REGEX=\s(dhcpd).+]\:\s(DHCPACK)\sto\s(\S+)\s(?:\(([^\)]+)\)\s)?via\s(\S+) FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 dest_int::$5
Here are two events which get hit by these two respective regexes.
10:27:33.000 AM Sep 27 10:27:33 184.108.40.206 dhcpd: DHCPACK on 220.127.116.11 to 00:aa:bb:cc:dd:ee (somehostname) via eth1 relay eth1 lease-duration 1814400 (RENEW) Sep 27 10:27:33 18.104.22.168 dhcpd: DHCPACK to 22.214.171.124 (00:bb:cc:11:22:33) via eth1
When I search for my source type i do not get my fields extracted. I've tested the regex, it is fine. I am at loss how else I can troubleshoot this.
Are you aliasing those fields later?
If you alias fields in the props.conf file and you use for example:
FIELDALIAS- = (origfieldname AS|ASNEW newfieldname)
In case you use AS, if the original fieldname is not found splunk deletes the new fieldname, so if for some reason a event does not contain it, it would delete the new, to fix this problem, use ASNEW.
When these problem happens my approach is to read the .conf documentation