We are trying to extract both fields and their names from events that have a variable number of elements. We have determined that using a field transformation is the best way to do this, in order to have multi-valued fields. The names of the fields will be built using the elements in the event.
An example event:
2019-06-21 14:30 Total Points Player: Red Score: 17,Player: Blue Score: 8,Player: Green Score: 12,Player: Blue Score: 11,Player: Yellow Score: 7,Player: Yellow Score: 10
We would like to extract several fields that look like the this:
Player_Red_Score: 17
Player_Blue_Score: 8
11
Player_Green_Score: 12
Player_Yellow_Score: 7
10
The field transformation regular expression is:
(\w+) Score: (\d+)
And its format is:
Player_$1_Score::$2
But we end up with fields named Player_$1_Score .
How can we define custom names for these fields by concatenating static text with an extracted field name? I see that this can be done as shown in the documentation here:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Configureindex-timefieldextraction
Any idea what might be going wrong?
... View more
