All Apps and Add-ons

Issue extracting field from host metadata

john_byun
Path Finder

I am able to successfully extract the field at search time from the "host" field using rex with the following:

source="XXX" | rex field=host s(?P<storeNo>\d\d\d)store

When I try to add this using the Interactive Field Extractor and test it, it does not work. When I run a test, I can see that it adds quotations. The search below with quotes does not work.

source="XXX" | rex "field=host s(?P<storeNo>\d\d\d)store"

It looks like this in the props.conf file:

EXTRACT-storeNo = field=host s(?P<storeNo>\d\d\d)store

How do I make this a persistent field?

0 Karma
1 Solution

kristian_kolb
Ultra Champion

You should a few sample events containing the string you want to extract.

The rex statement should have the starting double quote after the field=fieldname specification. You seem to have noted that your config didn't work.

Probably the props.conf config should be;

EXTRACT-blah = \ss(?<storeNo>\d\d\d)store\s in host

From the docs regarding props.conf

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

EXTRACT-<name> = [<regex>|<regex> in <src_field>]
* Used to create extracted fields (search-time field extractions) that do not reference
transforms.conf stanzas.
* Performs a regex-based field extraction from the value of the source field.
* The <regex> is required to have named capturing groups. When the <regex> matches, the named
capturing groups and their values are added to the event.
* Use '<regex> in <src_field>' to match the regex against the values of a specific field.
Otherwise it just matches against _raw (all raw event data).
* NOTE: <src_field> can only contain alphanumeric characters (a-z, A-Z, and 0-9).
* If your regex needs to end with 'in <string>' where <string> is *not* a field name, change
the regex to end with '[i]n <string>' to ensure that Splunk doesn't try to match <string>
to a field name.

/K

View solution in original post

kristian_kolb
Ultra Champion

You should a few sample events containing the string you want to extract.

The rex statement should have the starting double quote after the field=fieldname specification. You seem to have noted that your config didn't work.

Probably the props.conf config should be;

EXTRACT-blah = \ss(?<storeNo>\d\d\d)store\s in host

From the docs regarding props.conf

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

EXTRACT-<name> = [<regex>|<regex> in <src_field>]
* Used to create extracted fields (search-time field extractions) that do not reference
transforms.conf stanzas.
* Performs a regex-based field extraction from the value of the source field.
* The <regex> is required to have named capturing groups. When the <regex> matches, the named
capturing groups and their values are added to the event.
* Use '<regex> in <src_field>' to match the regex against the values of a specific field.
Otherwise it just matches against _raw (all raw event data).
* NOTE: <src_field> can only contain alphanumeric characters (a-z, A-Z, and 0-9).
* If your regex needs to end with 'in <string>' where <string> is *not* a field name, change
the regex to end with '[i]n <string>' to ensure that Splunk doesn't try to match <string>
to a field name.

/K

john_byun
Path Finder

Thank you. Replacing 'field=host' to 'in host' fixed the issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...