Splunk Search

Index time field extraction from another field

rahiparikh
Explorer

Hi,

I have two fields. Let's say they are field1 and field2. I extract field2 from field1. I also remove some part of field1 to give it appropriate value. Now, if I don't correct value of field1, I get field2. But, if I don't correct field1, I don't get field2 at all.

[transforms.conf]

[autocorrect_field1]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2>)(<regex3>)
DEST_KEY = field1
WRITE_META = true
FORMAT = field1::$1$3

[extract_field2]
SOURCE_KEY = field1
REGEX = (<regex1>)(<regex2.1>)(<regex2.2>)(<regex3>)
DEST_KEY = field2
FORMAT = field2::$2
WRITE_META = true

I have also set 101 priority for field2 in props.conf. What is the issue?

Thanks!

0 Karma

woodcock
Esteemed Legend

Your props.conf needs to specify them in the correct order like this:

TRANSFORMS-correct = autocorrect_field1, extract_field2

Instead of what you are currently doing:

TRANSFORMS-wrong= extract_field2, autocorrect_field1
0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...