https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-universal-forwarder-to-parse-log-files-with-a-key/m-p/425984#M74657 <P>Hello,</P> <P>I'm trying to parse log entries that look like so </P> <PRE><CODE>EventTime=2018-12-07 10:06:31,Hostname=WIN-UE7JIIAK3IG.nxlog.co,Keywords=36028797018963968,EventType=INFO,SeverityValue=2,Severity=INFO,EventID=1,SourceName='My Script',TaskValue=1,RecordNumber=3169,ExecutionProcessID=0,ExecutionThreadID=0,Channel=Application,Message='This is a test message 1.',Opcode=Info,EventData='&lt;Data&gt;This is a test message 1.&lt;/Data&gt;',EventReceivedTime=2018-11-26 14:16:31,SourceModuleName=filein,SourceModuleType=mymodulelog, EventTime=2018-12-07 10:16:33,Hostname=WIN-UE7JIIAK3IG.nxlog.co,Keywords=36028797018963968,EventType=INFO,SeverityValue=2,Severity=INFO,EventID=1,SourceName='My Script',TaskValue=1,RecordNumber=3170,ExecutionProcessID=0,ExecutionThreadID=0,Channel=Application,Message='This is a test message 2.',Opcode=Info,EventData='&lt;Data&gt;This is a test message 2.&lt;/Data&gt;',EventReceivedTime=2018-11-26 14:16:33,SourceModuleName=filein,SourceModuleType=mymodulelog, </CODE></PRE> <P>I'd like to forward these to my indexer on the Splunk cloud, and be searchable via field names. Something that is not clear to me is how I configure my inputs.conf and props.conf to handle such data.</P> Fri, 07 Dec 2018 10:53:33 GMT cameronharris6 2018-12-07T10:53:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-universal-forwarder-to-parse-log-files-with-a-key/m-p/425984#M74657 <P>Hello,</P> <P>I'm trying to parse log entries that look like so </P> <PRE><CODE>EventTime=2018-12-07 10:06:31,Hostname=WIN-UE7JIIAK3IG.nxlog.co,Keywords=36028797018963968,EventType=INFO,SeverityValue=2,Severity=INFO,EventID=1,SourceName='My Script',TaskValue=1,RecordNumber=3169,ExecutionProcessID=0,ExecutionThreadID=0,Channel=Application,Message='This is a test message 1.',Opcode=Info,EventData='&lt;Data&gt;This is a test message 1.&lt;/Data&gt;',EventReceivedTime=2018-11-26 14:16:31,SourceModuleName=filein,SourceModuleType=mymodulelog, EventTime=2018-12-07 10:16:33,Hostname=WIN-UE7JIIAK3IG.nxlog.co,Keywords=36028797018963968,EventType=INFO,SeverityValue=2,Severity=INFO,EventID=1,SourceName='My Script',TaskValue=1,RecordNumber=3170,ExecutionProcessID=0,ExecutionThreadID=0,Channel=Application,Message='This is a test message 2.',Opcode=Info,EventData='&lt;Data&gt;This is a test message 2.&lt;/Data&gt;',EventReceivedTime=2018-11-26 14:16:33,SourceModuleName=filein,SourceModuleType=mymodulelog, </CODE></PRE> <P>I'd like to forward these to my indexer on the Splunk cloud, and be searchable via field names. Something that is not clear to me is how I configure my inputs.conf and props.conf to handle such data.</P> Fri, 07 Dec 2018 10:53:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-universal-forwarder-to-parse-log-files-with-a-key/m-p/425984#M74657 cameronharris6 2018-12-07T10:53:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-universal-forwarder-to-parse-log-files-with-a-key/m-p/425985#M74658 <P>Universal forwarders do not parse data. That's done by indexers and heavy forwarders (that is not to imply you should replace a UF with a HF).</P> <P>Inputs.conf goes on the UF. Props.conf goes on the indexer.</P> <P>See <A href="https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F</A></P> Fri, 07 Dec 2018 12:53:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-universal-forwarder-to-parse-log-files-with-a-key/m-p/425985#M74658 richgalloway 2018-12-07T12:53:21Z