I have props.conf defined as-
[source::C:\Web\...\...\Web\log\mobile.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source
[source::C:\Web\...\...\Web\log\web.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source
I am still unable to index the two fields. What am I doing wrong?
Do I need to make some other changes?
Hello Siddharthmis,
Your problem is not in the regex, it is in the stanza.
the stanzas should look like this :
[source::C:\Web\*\*\Web\log\mobile.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source
[source::C:\Web\*\*\Web\log\web.log]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source
please refer to the following question for more details:
https://answers.splunk.com/answers/31643/using-source-for-field-extraction-in-props-conf.html
Regards,
David
Thanks, it worked.
[<SOURCETYPEHERE>]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source
[<SOURCETYPEHERE>]
EXTRACT-Customer,Country = C:\\\Web\\\(?<Customer>\w*)\\\(?<Country>\w*) in source
I used the above, though.
Great! Please accept and up vote answer 🙂
Hi siddharthmis,
you can try rex command on source field:
| rex field=source "\w+:\\w+\(?P\w*)\(?P\w*)\.*"
Hi @siddharthmis
can you please share your source string