Splunk Search

Field extraction and Splunk forwarding

lrhazi
Path Finder

I have systems sending data to splunk1 in the form: k1=v1 k2=v2
I have field extraction configured for the sourcetype,to extract those fields as name1 and name2. This works fine.
I have another system sending similar data to splunk2, which is configured to route it, based our "source" to splunk1.

the data from this remote system, though it has the correct sourcetype, does not get my custom field extraction applied, instead I get the automatic fields extracted with thier short names, k1, k2.

I tried adding my extraction rules to props/transforms on splunk2, in addition to splunk1, but to no avail. How can I fix this?

Tags (1)
0 Karma

lguinn2
Legend

Are your field extractions search-time or index-time? They should be search-time. Can you post your props.conf and transforms.conf so we can see them?

If your field extractions are index-time, they will not apply retroactively to data that has already been indexed. (One of the several disadvantages of index-time fields.) Search-time field extractions apply to all data, regardless of when it was indexed.

If you aren't sure whether your field extractions are search-time or index-time, check out the links below. Also, we will be able to tell once we see the .conf files.
Useful links:

http://docs.splunk.com/Documentation/Splunk/latest/admin/Indextimeversussearchtime

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac...

0 Karma

lguinn2
Legend

Glad it worked. This is search-time field extraction BTW.

0 Karma

lrhazi
Path Finder

Thanks a lot for the links... which lead me to "Field aliasing", which is really all I needed, Splunk already parses and extract my fields correctly, just needed them renamed, and aliasing seems to work just fine too!

lrhazi
Path Finder

Thanks a alot.. My extractions are like what follows.. I guess index-time?

props.conf:

[bigip-syslog]
REPORT-gtm-dns-fields = gtm-dns-fields-1

transforms.conf:
[gtm-dns-fields-1]
REGEX = v=([\d.]+):? c=([\d.]+)
FORMAT = vip::$1 client::$2

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...