Extract fields during source type creation

[jayakumar89]

I have log file that has combination of plain text and key value pairs separated by "|". How can i extract all the fields from log. below is the sample data I'm trying to index.

01/16/2017 11:09:15|SNMPv2c|hostname|IP address|0|sonusNodeServerCongestionNotification|sysUpTime : 98677211|snmpTrapOID : sonusNodeServerCongestionNotification|sonusShelfIndex : 1|sonusSlotIndex : 5|sonusOverloadLevel : 1|sonusEventDescription : Shelf 1 slot 5 card congestion level 1.|sonusEventClass : 1|sonusEventLevel : 2|sonusSequenceId : 57031|sonusEventTime : 1484582955|sonusSequenceEpoch : 41|hostID

[somesoni2 · Accepted solution]

You can add following on your Search Head

props.conf

[YourSourceType]
REPORT-getfields = extract_kv_pairs

transforms.conf

[extract_kv_pairs]
DELIMS = "|", ":"

Restart Splunk after making change.

[jayakumar89]

@somesonie Thanks and it works. I would like to extract the first 5 fields and provide FIELD-NAME to them. how can i do that ?

[somesoni2]

YOu need to setup field extraction in props.conf like this.

props.conf

 [YourSourceType]
 REPORT-getfields = extract_kv_pairs
 EXTRACT-firstfive = ^(?<fieldname1>[^\|]+)\|(?<fieldname2>[^\|]+)\|(?<fieldname3>[^\|]+)\|(?<fieldname4>[^\|]+)\|(?<fieldname5>[^\|]+)\|

[jayakumar89]

It helped. Thanks.