concatenating fields at index time doesn't seem to work. I have the following transform:
the data looks like:
I would expect to see a value for td_nv of BW400 after the search. However, the transform remains in its unprocessed state indicating that td_nv is simply "$1.$2". If I just use $1 or $2 it is evaluated correctly with that piece.
This is described in the splunk docs section under "create custom fields at index time". Any ideas?
There might be a couple of issues here but try this and let me know if it works:
The "<" and ">" have to be escaped with a backslash "". Also if you are creating a grouping in the REGEX then the FORMAT has to be "$1::$2".
Here is a link to more information:
answered 01 Dec '11, 07:15
Tried it with both FORMAT suggestions with no change so far. The props.conf entry is below. FYI, all the other extracts and reports pieces work.
[MyLogs] TRUNCATE = 0 LINE_BREAKER = (?!) BREAK_ONLY_BEFORE = ^<segname> TIME_PREFIX = ^<start>s+ EXTRACT-segName = ^<segname> (?<segname>[^n]+) EXTRACT-testName = ^<testname> (?<testname>[^n]+) EXTRACT-testExec = ^<testexec> (?<testexec>[^n]+) EXTRACT-npes = ^<npes> (?<npes>[^n]+) EXTRACT-JobID = ^<jobid> (?<jobid>[^n]+) EXTRACT-compiler = ^<compiler> (?<compiler>[^n]+) EXTRACT-params = ^<params> (?<params>[^n]+) EXTRACT-rmgr = ^<rmgr> (?<rmgr>[^n]+) EXTRACT-user = ^<user> (?<user>[^n]+) EXTRACT-vers = ^<vers> (?<vers>[^n]+) EXTRACT-start = ^<start> (?<start>[^n]+) EXTRACT-end = ^<end> (?<end>[^n]+) EXTRACT-results = ^s*<results?>s+(?<results>[^n]+) EXTRACT-nodes = ^<nodes> (?<nodes>[^n]+) EXTRACT-real = ^reals+(?<runtime>[^n]+) REPORT-gztd = gztd REPORT-gztdnv = gztdnv REPORT-gzresults = gzresults
answered 01 Dec '11, 08:18
You're using REPORT instead of TRANSFORMS for the fields you are trying to concatenate. REPORT is a definition for a search-time extraction, not an index-time extraction. You need to use TRANSFORMS if you want to concatenate values, as this is not supported for search-time extractions.
answered 01 Dec '11, 12:21
no luck so far... here are the three key files. Restarted splunk and no td_nv field even appears....
[gztdnv] REGEX = s+(S+)s+(S+)s+(S+) FORMAT = td_nv::"$1.$2" WRITE_META = true
[mylogs] TRANSFORMS-gztdnv = gztdnv
answered 01 Dec '11, 13:45