regex to pick a event

[e82than]

Hi all,

I have a question to ask about using regex to recognize a field. I did manage to pick the field out from my regex testing kit. But when i try to input to splunk it can't work. I wonder where did i go wrong.

In my transforms.conf

[Ftype1]
REGEX = .*\[2\].*\[16\].*\[(1234............)\]
FORMAT = F1::$1

In my props.conf

[host::MyPC]
SHOULD_LINEMERGE = true

[Ftype2]
TRANSFORMS-Ftype1=Ftype3

What i am trying to do now is to make the field recognize-able then get splunk to stats the field. Can any one help?

[kristian_kolb]

Well one thing is that you are not referencing the transform correctly. You should put Ftype1 in props.conf where you now have Ftype3. Possibly also change the name of the transform "name" so that it's not the same as the value.

props.conf

[sourcetype]
TRANSFORMS-this_is_just_a_name = transform_stanza

transforms.conf

[transform_stanza]
REGEX blaha bhal
FORMAT blaha 

UPDATE:

Ok, if your are doing 'normal' field extractions, there is no need to use transforms. This can be done in props.conf alone.

If you need to use transforms, then you should use the REPORT- attribute rather than EXTRACT-

BUT you need to get your reference right. See where I put the 'bbbb' in the examples below. The 'aaaa' is just a name - it could be set to anything, but to avoid confusion, don't set is to the same string as 'bbbb', ok.

props.conf

[host::blaha]
REPORT-aaaa = bbbb

transforms.conf

[bbbb]
REGEX= your regex goes here
FROMAT = whatever you wish to put here

Hope this helps,

Kristian

[kristian_kolb]

see updates above.

[e82than]

kristian, bear with me ok. I'm noob on this. I changed transforms into extract in props.conf as i realised i'm trying to do a search time field tagging

props.conf

[host::user-PC]
SHOULD_LINEMERGE = true
EXTRACT-banktype2=banktype3

transforms.conf

[banktype2]

REGEX = .[2].[16].*[(4679............)]

FORMAT = BANK1::$1

I'm having a problem to show a regex here. there's a dot asterisk missing in the banktype2.