PROPS issue - Doing an EXTRACT from a REPORT field

[raziasaduddin]

Can I have a REPORT line AND an EXTRACT LINE in my props.conf for a sourcetype even if the report is for a delimited list?

My proxy logs have a field named proxy_sourceip_sourceport. That is extracted fine via the REPORT line because the logs are tab delimited.
Can I have an EXTRACT based on that field alone or do I have to do it for the whole line?
It is not working an they are in alphabetical order.

Props:

[proxylogs]
REPORT-proxy_delim_tab = proxy_search
EXTRACT-proxy_src_ip = (?<proxy_src_ip>.+?):  in proxy_sourceip_sourceport

Transforms:

[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc

[_d_]

The reason that is not working is because EXTRACT is evaluated before a REPORT, i.e the field generated by the latter is not available when the former is called.
Two REPORTS called in the proper order is the correct course of action here.

[Ayn · Accepted solution]

A better idea would be to use REPORT for your second extraction as well.

props.conf:

[proxylogs]
REPORT-proxy_fields = proxy_search, proxy_src_ip

transforms.conf:

[proxy_search]
CLEAN_KEYS = false
DELIMS = \t
FIELDS = proxy_sourceip_sourceport, proxy_time, proxy_url, etc

[proxy_src_ip]
SOURCE_KEY = proxy_sourceip_sourceport
REGEX = (.+?):
FORMAT = proxy_src_ip::$1