topic Header Field and Values in Splunk Search

Header Field and Values

bartstk18 — Tue, 05 Jan 2021 20:30:44 GMT

I have a Splunk event with the following lines logged from a .txt file.

HeaderField1 | HeaderField2 | HeaderField3

HeaderValue1 | HeaderValue2 | HeaderValue3

How can I manipulate the event (and future events) using configuration files (props and/or transform) so that the event text is replaced with the following extracted fields names and values:

HeaderField1 = HeaderValue1

HeaderField2 = HeaderValue2

HeaderField3 = HeaderValue3

Note: The actual header field names are always the same. The Header Values change in each text file.

Re: Header Field and Values

scelikok — Tue, 05 Jan 2021 21:04:52 GMT

Hi @bartstk18,

You can use below settings in conf files,

props.conf [txt_sourcetype] REPORT-fieldname=field_headers transforms.conf [field_headers] DELIMS = "|" FIELDS = HeaderField1 HeaderField2 HeaderField3

If this reply helps you an upvote is appreciated.

Re: Header Field and Values

bartstk18 — Tue, 05 Jan 2021 21:33:21 GMT

@scelikokUnfortunately this did not work. The event has been logged the same and the fields were not extracted.

Re: Header Field and Values

scelikok — Tue, 05 Jan 2021 21:39:40 GMT

That setting should be in Search Head, and will affect already indexed and future data.

Can you please share a few lines of data from your txt file and your sourcetype configuration?

Re: Header Field and Values

richgalloway — Tue, 05 Jan 2021 21:59:59 GMT

I've done that in the past. The only way I could figure out to do it was to write a python script that read the file, reformatted it, and wrote the results to stdout for indexing.