https://community.splunk.com/t5/Getting-Data-In/breaking-down-segments-of-events/m-p/94206#M19601 <P>hi...</P> <P>I need to break down my event logs.<BR /> I'm getting confused in configuring transform.conf, props.conf, etc...</P> <P>this a sample of one line of my data:</P> <PRE><CODE>I, [2011-04-01T00:01:04.883503 #1023] INFO -- : [2011-04-01 00:01:03,153.30.11.29,12345,192.225.180.55,654,bumiflow.com.my,MX,IN] </CODE></PRE> <P>(for confidentiality reasons, I've changed data values... but the format follows the same)</P> <P>so currently, splunk is able to map the source ip, and also identifies the time.</P> <P>I want to break down all the rest of the event as well based on resource records (MX, A, AAAA, etc.), domains, etc..<BR /> firstly, Can I do that from splunk manager? probably "Manager&gt;fiels"...<BR /> if not, can you guide me through configuring the conf files..</P> <P>thank you.</P> Wed, 19 Oct 2011 09:43:22 GMT nina15 2011-10-19T09:43:22Z https://community.splunk.com/t5/Getting-Data-In/breaking-down-segments-of-events/m-p/94206#M19601 <P>hi...</P> <P>I need to break down my event logs.<BR /> I'm getting confused in configuring transform.conf, props.conf, etc...</P> <P>this a sample of one line of my data:</P> <PRE><CODE>I, [2011-04-01T00:01:04.883503 #1023] INFO -- : [2011-04-01 00:01:03,153.30.11.29,12345,192.225.180.55,654,bumiflow.com.my,MX,IN] </CODE></PRE> <P>(for confidentiality reasons, I've changed data values... but the format follows the same)</P> <P>so currently, splunk is able to map the source ip, and also identifies the time.</P> <P>I want to break down all the rest of the event as well based on resource records (MX, A, AAAA, etc.), domains, etc..<BR /> firstly, Can I do that from splunk manager? probably "Manager&gt;fiels"...<BR /> if not, can you guide me through configuring the conf files..</P> <P>thank you.</P> Wed, 19 Oct 2011 09:43:22 GMT https://community.splunk.com/t5/Getting-Data-In/breaking-down-segments-of-events/m-p/94206#M19601 nina15 2011-10-19T09:43:22Z https://community.splunk.com/t5/Getting-Data-In/breaking-down-segments-of-events/m-p/94207#M19602 <P>I would simply do field extractions or define event types from a search in the Search app.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.2.4/knowledge/Defineeventtypes">http://docs.splunk.com/Documentation/Splunk/4.2.4/knowledge/Defineeventtypes</A> <A href="http://docs.splunk.com/Documentation/Splunk/4.2.4/User/ExtractNewFields">http://docs.splunk.com/Documentation/Splunk/4.2.4/User/ExtractNewFields</A></P> Thu, 27 Oct 2011 18:16:40 GMT https://community.splunk.com/t5/Getting-Data-In/breaking-down-segments-of-events/m-p/94207#M19602 ignetops 2011-10-27T18:16:40Z