Splunk Search

REX not working in props.conf

hartfoml
Motivator

I am using this rex command

| rex max_match=100 "(?i)<severity>(?P<Severity>[^<]+)"

When I add this to the props.conf like this

EXTRACT-Severity = max_match=100 (?i)<severity>(?P<Severity>[^<]+)

I get no return at all

If I use this in the props.conf

EXTRACT-Severity = (?i)<severity>(?P<Severity>[^<]+)

I only get the first return in the event not all the other possible returns in the event

Can anyone help with this rex conversion to props.conf

Tags (1)
0 Karma
1 Solution

joshd
Builder

props.conf wont understand the max_match parameter, that is specific to the rex command... so you cannot use it there.

Now what do you mean you only get the first return in the event and not all other possible returns? Do you mean in a single event there are multiple Severity levels that could be reported?

If so you could look at using a transform for this...

in transforms.conf :

[get_severity]
REGEX = \<severity\>([^<]+)
FORMAT = Severity::$1
MV_ADD = true

then add in props.conf :

REPORT-severity = get_severity

View solution in original post

0 Karma

joshd
Builder

props.conf wont understand the max_match parameter, that is specific to the rex command... so you cannot use it there.

Now what do you mean you only get the first return in the event and not all other possible returns? Do you mean in a single event there are multiple Severity levels that could be reported?

If so you could look at using a transform for this...

in transforms.conf :

[get_severity]
REGEX = \<severity\>([^<]+)
FORMAT = Severity::$1
MV_ADD = true

then add in props.conf :

REPORT-severity = get_severity
0 Karma

Ayn
Legend
0 Karma

smolcj
Builder

can u explain the option FORMAT.. how to define that if we have more than one multivalued fields to extract from one event
thank you

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...