topic Re: How to extract fields from multiple file source names? in Splunk Search

How to extract fields from multiple file source names?

sfatnass — Fri, 20 May 2016 14:48:23 GMT

Hi everybody,

I'm trying to extract fields from multiple source names.
It worked for one filename, but I have a lot of files.

It doesn't work with this example :
source::/path/*

if any body can help me thx

Re: How to extract fields from multiple file source names?

somesoni2 — Fri, 20 May 2016 14:56:53 GMT

You would need to provide some values, expected result (field names and values that needs to be extracted), and your last attempted search.

Re: How to extract fields from multiple file source names?

sfatnass — Fri, 20 May 2016 15:35:44 GMT

I will use regex To provide some values.
But how can i do if i have multiple source like 100000 file logs.

Re: How to extract fields from multiple file source names?

somesoni2 — Fri, 20 May 2016 15:41:54 GMT

Still not clear to me what you're trying to do here. Do you want to setup a field extraction, in props.conf, for multiple sources? OR you're want to extract a field, from the portion of the source field value?

Re: How to extract fields from multiple file source names?

sfatnass — Fri, 20 May 2016 16:02:09 GMT

I want To setup a field extraction in props.conf for multiple sources.

Re: How to extract fields from multiple file source names?

somesoni2 — Fri, 20 May 2016 17:52:54 GMT

Something like this should work

props.conf on Search Head

[source::/path/*]
EXTRACT-identifier=yourREGEXtoEXTRACTfield

It would be easier to set it up based on sourcetype as it's number should be low. Do these sources report on different sourcetypes?

Re: How to extract fields from multiple file source names?

rdagan_splunk — Tue, 29 Sep 2020 09:48:42 GMT

Have you tried this?
[source::/path*/...]
instead of this?
[source::/path/*]

Re: How to extract fields from multiple file source names?

sfatnass — Thu, 02 Jun 2016 08:52:22 GMT

i resolve it by using field transform thx

for all reply ^^