Hi all,
I have a question to ask about using regex to recognize a field. I did manage to pick the field out from my regex testing kit. But when i try to input to splunk it can't work. I wonder where did i go wrong.
In my transforms.conf
[Ftype1]
REGEX = .*\[2\].*\[16\].*\[(1234............)\]
FORMAT = F1::$1
In my props.conf
[host::MyPC]
SHOULD_LINEMERGE = true
[Ftype2]
TRANSFORMS-Ftype1=Ftype3
What i am trying to do now is to make the field recognize-able then get splunk to stats the field. Can any one help?
Well one thing is that you are not referencing the transform correctly. You should put Ftype1 in props.conf where you now have Ftype3. Possibly also change the name of the transform "name" so that it's not the same as the value.
props.conf
[sourcetype]
TRANSFORMS-this_is_just_a_name = transform_stanza
transforms.conf
[transform_stanza]
REGEX blaha bhal
FORMAT blaha
UPDATE:
Ok, if your are doing 'normal' field extractions, there is no need to use transforms. This can be done in props.conf alone.
If you need to use transforms, then you should use the REPORT- attribute rather than EXTRACT-
BUT you need to get your reference right. See where I put the 'bbbb' in the examples below. The 'aaaa' is just a name - it could be set to anything, but to avoid confusion, don't set is to the same string as 'bbbb', ok.
props.conf
[host::blaha]
REPORT-aaaa = bbbb
transforms.conf
[bbbb]
REGEX= your regex goes here
FROMAT = whatever you wish to put here
Hope this helps,
Kristian
see updates above.
kristian, bear with me ok. I'm noob on this. I changed transforms into extract in props.conf as i realised i'm trying to do a search time field tagging
props.conf
[host::user-PC]
SHOULD_LINEMERGE = true
EXTRACT-banktype2=banktype3
transforms.conf
[banktype2]
REGEX = .[2].[16].*[(4679............)]
FORMAT = BANK1::$1
I'm having a problem to show a regex here. there's a dot asterisk missing in the banktype2.