Splunk Search

How to extract fields from a specific field instead of raw data using the conf files?

rsimmons
Splunk Employee
Splunk Employee

How to extract fields from a specific field instead of raw data using the conf files? Can it be done with EXTRACT-<class> = [<regex>|<regex> in <src_field>] in props.conf?

0 Karma

gcato
Contributor

Hi rsimmons,

Looks like this has already been answered here: https://answers.splunk.com/answers/47982/extracting-field-from-a-field-other-than-raw-in-props-conf....

You need to use transforms configuration instead.

Hope this helps.

0 Karma

rsimmons
Splunk Employee
Splunk Employee

The extract fields command only works on raw data with transforms.conf however not with index data. The extractions is done via kv_mode=auto for the fields.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...