Field Extraction

[Ravan]

How to extract the fields from below sample output .

ONLN|2011-12-03 16:58:13.000|cmfciohqpict006|455|cmfciohqpict006|ppadmin|0|DRTB|proteus|335|system_historytmp||||informix|0|2097682|

Field Details are as below

1.Instant type
2.Date and time
3.Hostname
4.pid
5.dbservername
6.user name
7.errno
8.Event
9.Other

[yannK]

define a field extraction in props.conf and transforms.conf for your sourcetype
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf

by example, if your sourcetype is mysourcetype
in .../local/props.conf
[mysourcetype]
TRANSFORMS-extractmyfields=extract_mysourcetype

in .../local/transforms.conf
[extract_mysourcetype]
DELIMS = "|"
FIELDS = "InstantType","DateAndTime", "Hostname, "pid", "dbservername", "user", "name", "errno", "Event", "Other"