Splunk Search

props/transforms REPORT- extracting



I am having issues doing search time extraction via REPORT- command in props and transforms.
Here is my code.


KV_MODE = none
EXTRACT-myEventType = some regex which does work to extract one field
REPORT-myDHCP = dhcpack_type1, dhcpack_type2


FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 src_host::$5 dest_int::$6

FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 dest_int::$5

Here are two events which get hit by these two respective regexes.

10:27:33.000 AM     

Sep 27 10:27:33 dhcpd[12345]: DHCPACK on to 00:aa:bb:cc:dd:ee (somehostname) via eth1 relay eth1 lease-duration 1814400 (RENEW)

Sep 27 10:27:33 dhcpd[12345]: DHCPACK to (00:bb:cc:11:22:33) via eth1

When I search for my source type i do not get my fields extracted. I've tested the regex, it is fine. I am at loss how else I can troubleshoot this.


Path Finder

Are you aliasing those fields later?
If you alias fields in the props.conf file and you use for example:
FIELDALIAS- = (origfieldname AS|ASNEW newfieldname)

In case you use AS, if the original fieldname is not found splunk deletes the new fieldname, so if for some reason a event does not contain it, it would delete the new, to fix this problem, use ASNEW.

When these problem happens my approach is to read the .conf documentation

0 Karma

Splunk Employee
Splunk Employee

I would start by checking the metadata/*.meta files and verify that those extractions are permissioned correctly.

0 Karma


I have the following in default.meta:

access = read : [ * ], write : [ admin ]
export = system

0 Karma