Hello @jwhughes58 , Using REPORT, you generally call the transforms stanza that has the transformations written for extractions, routing, etc. You can simply write the regex that matches against _ra...
See more...
Hello @jwhughes58 , Using REPORT, you generally call the transforms stanza that has the transformations written for extractions, routing, etc. You can simply write the regex that matches against _raw and extract the field required. If you use REPORT and call the transforms to extract the field, the same thing will happen. If you necessarily want to use EXTRACT, you need to extract the Match_Details.match.properties.user field at index time and replace the (.) with (_). Then you'll be able to use EXTRACT parameter in props.conf for search time field extractions. Additionally, you can also consider using rex command in the SPL query to extract the fields at search time. Relevant documents: https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Propsconf https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Rex Thanks, Tejas. --- If the above solution helps, an upvote is appreciated.