Splunk Search

How to make a "rex" search a permanent field extraction in props.conf and transforms.conf?

changux
Builder

Hi all,

I have this expression to extract the character part of one string:

... | rex field=Equipment "^(?<TEST>^[a-zA-Z]+)"

The field Equipment has content like MC01. I need the character part, in this case: MC and with the above search, it works like a charm.

To make this field extraction permanent, i tried:

My props.conf

[sourcetype1]
...
REPORT-test = TEST

And in transforms.conf:

[TEST]
SOURCE_KEY = Equipment
REGEX = ^(?<TEST>[\d+$])

But doesn't work (i can't see the new field in a search after restarting Splunk). I think that inside transforms.conf the regular expression must be different (i don't know) because when i remove the ^ at beginning of regex (to do a test), I can see the field in search with 0 and 1 values.

Any suggestion?

0 Karma
1 Solution

gokadroid
Motivator

If the field to be caught is like MC out of MC01 your current regex REGEX = ^(?<TEST>[\d+$]) is not going to catch it. It is saying catch anything which starts with either a digit, plus sign or dollar sign and catch only one charater Please use below regex:

REGEX = ^([A-Z][A-Z]) which will strictly catch it.
OR
REGEX = ^(.{2}) which will catch the first two characters whatever it is

View solution in original post

0 Karma

gokadroid
Motivator

If the field to be caught is like MC out of MC01 your current regex REGEX = ^(?<TEST>[\d+$]) is not going to catch it. It is saying catch anything which starts with either a digit, plus sign or dollar sign and catch only one charater Please use below regex:

REGEX = ^([A-Z][A-Z]) which will strictly catch it.
OR
REGEX = ^(.{2}) which will catch the first two characters whatever it is

0 Karma

changux
Builder

You right! My mistake. How i can capture the number part of the Equipment field?

0 Karma

gokadroid
Motivator

you can try the following:
REGEX = .*(\d{2})

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...