topic Extract fields during source type creation in Getting Data In

Extract fields during source type creation

jayakumar89 — Tue, 31 Jan 2017 20:30:59 GMT

I have log file that has combination of plain text and key value pairs separated by "|". How can i extract all the fields from log. below is the sample data I'm trying to index.

Re: Extract fields during source type creation

somesoni2 — Tue, 31 Jan 2017 22:02:32 GMT

You can add following on your Search Head

props.conf

[YourSourceType]
REPORT-getfields = extract_kv_pairs

transforms.conf

[extract_kv_pairs]
DELIMS = "|", ":"

Restart Splunk after making change.

Re: Extract fields during source type creation

jayakumar89 — Wed, 01 Feb 2017 15:50:22 GMT

@somesonie Thanks and it works. I would like to extract the first 5 fields and provide FIELD-NAME to them. how can i do that ?

Re: Extract fields during source type creation

somesoni2 — Wed, 01 Feb 2017 16:07:20 GMT

YOu need to setup field extraction in props.conf like this.

props.conf

 [YourSourceType]
 REPORT-getfields = extract_kv_pairs
 EXTRACT-firstfive = ^(?<fieldname1>[^\|]+)\|(?<fieldname2>[^\|]+)\|(?<fieldname3>[^\|]+)\|(?<fieldname4>[^\|]+)\|(?<fieldname5>[^\|]+)\|

Re: Extract fields during source type creation

jayakumar89 — Wed, 01 Feb 2017 20:31:26 GMT

It helped. Thanks.