props/transforms REPORT- extracting

[zislin]

Hello,

I am having issues doing search time extraction via REPORT- command in props and transforms.
Here is my code.

props.conf:

[mySourceType]
SHOULD_LINEMERGE = false
KV_MODE = none
EXTRACT-myEventType = some regex which does work to extract one field
REPORT-myDHCP = dhcpack_type1, dhcpack_type2

transforms.conf

[dhcpack_type1]
REGEX=\s(dhcpd).+]\:\s(DHCPACK)\son\s(\S+)\sto\s(\S+)\s(?:\(([^\)]+)\)\s)?via\s(\S+)
FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 src_host::$5 dest_int::$6

[dhcpack_type2]
REGEX=\s(dhcpd).+]\:\s(DHCPACK)\sto\s(\S+)\s(?:\(([^\)]+)\)\s)?via\s(\S+)
FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 dest_int::$5

Here are two events which get hit by these two respective regexes.

10:27:33.000 AM     

Sep 27 10:27:33 11.111.11.11 dhcpd[12345]: DHCPACK on 22.222.22.22 to 00:aa:bb:cc:dd:ee (somehostname) via eth1 relay eth1 lease-duration 1814400 (RENEW)

Sep 27 10:27:33 11.111.11.11 dhcpd[12345]: DHCPACK to 12.12.12.12 (00:bb:cc:11:22:33) via eth1

When I search for my source type i do not get my fields extracted. I've tested the regex, it is fine. I am at loss how else I can troubleshoot this.

Thanks.

[sonny_monti]

Are you aliasing those fields later?
If you alias fields in the props.conf file and you use for example:
FIELDALIAS- = (orig_field_name AS|ASNEW new_field_name)

In case you use AS, if the original fieldname is not found splunk deletes the new fieldname, so if for some reason a event does not contain it, it would delete the new, to fix this problem, use ASNEW.

When these problem happens my approach is to read the .conf documentation

[_d_]

I would start by checking the metadata/*.meta files and verify that those extractions are permissioned correctly.

[zislin]

I have the following in default.meta:

[]
access = read : [ * ], write : [ admin ]
export = system