Splunk Search

PROPS issue - Doing an EXTRACT from a REPORT field

raziasaduddin
Path Finder

Can I have a REPORT line AND an EXTRACT LINE in my props.conf for a sourcetype even if the report is for a delimited list?

My proxy logs have a field named proxy_sourceip_sourceport. That is extracted fine via the REPORT line because the logs are tab delimited.
Can I have an EXTRACT based on that field alone or do I have to do it for the whole line?
It is not working an they are in alphabetical order.

Props:

[proxylogs]
REPORT-proxy_delim_tab = proxy_search
EXTRACT-proxy_src_ip = (?<proxy_src_ip>.+?):  in proxy_sourceip_sourceport

Transforms:

[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc
Tags (1)
1 Solution

Ayn
Legend

A better idea would be to use REPORT for your second extraction as well.

props.conf:

[proxylogs]
REPORT-proxy_fields = proxy_search, proxy_src_ip

transforms.conf:

[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc

[proxy_src_ip]
SOURCE_KEY = proxy_sourceip_sourceport
REGEX = (.+?):
FORMAT = proxy_src_ip::$1

View solution in original post

_d_
Splunk Employee
Splunk Employee

The reason that is not working is because EXTRACT is evaluated before a REPORT, i.e the field generated by the latter is not available when the former is called.
Two REPORTS called in the proper order is the correct course of action here.

Ayn
Legend

A better idea would be to use REPORT for your second extraction as well.

props.conf:

[proxylogs]
REPORT-proxy_fields = proxy_search, proxy_src_ip

transforms.conf:

[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc

[proxy_src_ip]
SOURCE_KEY = proxy_sourceip_sourceport
REGEX = (.+?):
FORMAT = proxy_src_ip::$1
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...