Splunk Search

EXTRACTing a field from a src_field defined in a transform using "in"

bcavagnolo
Explorer

In transforms.conf, I have a transform defined like this:

[mytransform-fromlist]
REGEX = from=(?<fromlist>\w+)

I want to extract an additional field from the fromlist. I'm trying to do this in props.conf with something like this:

REPORT-fromlist = mytransform-fromlist
EXTRACT-from = (?<from>.*) in fromlist

Note that the trivial from regex is just for testing so that I can assure that the from field will show up in the search results.

When I run this search, I do see the fromlist field, but not the from field. I figure that somehow the fromlist is not available to EXTRACT-from at search time. But I can't find any documentation on this.

I also tried using a transform to extract the from field by adding this to transforms.conf:

[mytransform-from]
REGEX = (?<from>.*)
SOURCE_KEY = fromlist

...and a corresponding REPORT in props.conf like this:

REPORT-from = mytransform-from

Help!

Tags (2)
0 Karma
1 Solution

bcavagnolo
Explorer

Okay. I found the solution. You have to list the dependent field extractions. So elaborating on my second configuration attempt, the REPORT-from in props.conf should be like this:

REPORT-from = mytransform-fromlist, mytransform-from

I have lots of other extractions that depend on mytransform-fromlist, so hopefully splunk is smart enough to only run mytransform-fromlist once!

View solution in original post

bcavagnolo
Explorer

Okay. I found the solution. You have to list the dependent field extractions. So elaborating on my second configuration attempt, the REPORT-from in props.conf should be like this:

REPORT-from = mytransform-fromlist, mytransform-from

I have lots of other extractions that depend on mytransform-fromlist, so hopefully splunk is smart enough to only run mytransform-fromlist once!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...