Splunk Search

How to extract field values from another field using transforms.conf and props.conf?

edrivera3
Builder

Hi
I am trying to extract the field "block_num" from the field "block" during search-time. I've already extracted the field "block" correctly. I also tried this block_num extraction in the search app and it worked correctly. This is what I got:

transforms.conf:
[mvfield_block_num]
REGEX = Start-End\sSteps:\s(?<block_num>\d+-\d+)
SOURCE_KEY = fields:block
MV_ADD = true

props.conf
[tirfiles]
REPORT-block_num = mvfield_block_num

1 Solution

jacobwilkins
Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

View solution in original post

jacobwilkins
Communicator

How is the block field being extracted? You'd only use the fields: syntax if it were extracted with an INDEXED_EXTRACTIONS directive on the forwarder.

If it is being auto-extracted via KV_MODE, then you probably can't use it as a source key.

If you had a transform called [extract_block] that did the search-time extraction for that field, you'd want your props to look like this:

[tirfiles]
REPORT-block = extract_block, mvfield_block_num

This would be easier to answer if we had a bigger picture of your config, and a good sample of what was being extracted into block.

edrivera3
Builder

Ok.
Block is a multi-value field and it is extracted in search-time:

[tirfiles]
REPORT-step_block = mvfield_step_block

[mvfield_step_block]
REGEX = ---\n(?<block>Block\sStatus[\w\W\n]{1,20000}?)----\n
MV_ADD = true

0 Karma

edrivera3
Builder

I changed props.conf to REPORT-step_block = mvfield_step_block, mvfield_block_num and it worked correctly. Thank you.

edrivera3
Builder

I forgot to mention that "block" is a multi value field.

0 Karma

woodcock
Esteemed Legend

Use this instead:

SOURCE_KEY = block
0 Karma

edrivera3
Builder

I tried it, but it doesn't extract anything.

0 Karma

woodcock
Esteemed Legend

There is nothing more to say unless you post sample events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...