Splunk Search

How to configure props.conf for both of my search-time extractions (from another existing field)?

skender27
Contributor

Hi,

I'd rather need to know how to put in .conf files both the following (search-time) extractions.
sql_where_clause is an existing field.
Should I put one by one in props.conf, or it is better to use transforms.conf?

Thanks,
Skender

 |  rex field=sql_where_clause  "ccti_class = (?P<class>.*?) AND ccti_category = '(?P<category>.*?)' "
0 Karma
1 Solution

skender27
Contributor

I resolved it using only props.conf:

[my_sourcetype]
...
...
EXTRACT-my_extractions = ccti_class = \'(?<class>[\w\s]+)\'.*ccti_category = \'(?<category>[\w\s]+)\'

View solution in original post

0 Karma

skender27
Contributor

I resolved it using only props.conf:

[my_sourcetype]
...
...
EXTRACT-my_extractions = ccti_class = \'(?<class>[\w\s]+)\'.*ccti_category = \'(?<category>[\w\s]+)\'
0 Karma

skender27
Contributor

Hi,

Thanks for your comment!

I am trying, but could you suggest me the optimized regex to extract the two fields (class and category) to insert in the transforms.conf?
Here is the sample event:

ccti_class = 'Service Forniture' AND ccti_category = 'Computer science' AND ( ticket_type = 'Change Request' and ticket_impact_code = '2' ) AND ( ticket_type = 'Change Request' and ticket_urgency_code = '1' )

0 Karma

skender27
Contributor

Could it be correct this way?

transforms.conf
[class_category]
REGEX = <regex expression to extract two fields>
SOURCE_KEY = field:sys_where_clause


props.conf
[my_sourcetype]
REPORT-class_category = class_category
0 Karma

somesoni2
SplunkTrust
SplunkTrust

That will be correct if you want to use transforms.conf. For just props.conf, see this

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Createandmaintainsearch-timefieldextract...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...