topic Re: How to extract the fields in my raw event data at indexing time? in Splunk Search

How to extract the fields in my raw event data at indexing time?

kiran331 — Wed, 24 May 2017 19:12:44 GMT

Hi,

How to extract the fields in the below Raw event using props.conf and transforms.conf

05/24/17 13:22:12 abcxyz dbmslogin_c[100]: [ddslogin.c.c][370]: [SECURITY] Successful login attempt from user kirna331 at Book12:Opennet

action=Successful
user=kirna331
src=Book12
app=Opennet

Re: How to extract the fields in my raw event data at indexing time?

richgalloway — Wed, 24 May 2017 20:53:31 GMT

Try this

props.conf:

[mysourcetype]
TRANSFORM-foo = foo

transforms.conf:

[foo]
REGEX = ([^\s]+) login attempt from user ([^\s]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4

Re: How to extract the fields in my raw event data at indexing time?

sravankaripe — Thu, 25 May 2017 03:11:37 GMT

props.conf
[yourSourceType]
TRANSFORM-somename = somename

transforms.conf
[somename]
REGEX = ([^\w]+) login attempt from user ([^\w]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4