Prop & Transform a Sourcetype & a Sentenc

TitanAE — Tue, 02 Oct 2018 22:32:33 GMT

I have a Prop & Transform file. In it, I'm trying to parse a specific field and label it as a source type. I had it working before but now... it's a bit broken.

Transforms.conf

[audit_sourcetype_11]
REGEX = (AUDIT_Sourcetype_1)
FORMAT = sourcetype::Sourcetype_1_Name
DEST_KEY = MetaData:Sourcetype

[audit_sourcetype_22]
REGEX = (AUDIT_Sourcetype_22)
FORMAT = sourcetype::Sourcetype_2_Name
DEST_KEY = MetaData:Sourcetype

Props.conf

disabled = false
NO_BINARY_CHECK = true
disabled = false
pulldown_type = true

The other issue I'm having is that I have certain events and messages that show up like this:

[ System_Message = This is a system message ]

However Splunk parses it and displays it like this:

Field: System_Message
Value: This

How do I tell Splunk to look at the entire message. Not just the first character? In the same Transforms.conf?

Re: Prop & Transform a Sourcetype & a Sentenc

HiroshiSatoh — Wed, 03 Oct 2018 00:24:26 GMT

It is not a configuration file of the field definition.
If the field definition is bad, why not try redefining it from the GUI?

topic Prop & Transform a Sourcetype & a Sentenc in Getting Data In

Prop & Transform a Sourcetype & a Sentenc

Re: Prop & Transform a Sourcetype & a Sentenc