Getting Data In

Extract fields from filename and put it into event

WXY
Path Finder

I wang to extract field from event source filename.
The file path format shows:

D:\soft\logs\fv_1_Tom_lab1_20180701.txt

I want get two fields in my events
such as username=Tom; project=lab1

what should I do ?
How can I confige my props.conf and transforms.conf ,I use SplunkForward to forward my data

0 Karma

WalshyB
Path Finder

You could try this?

props.conf
[your_sourcetype]
EXTRACT-username,project = ^.*?\logs\D+\d_(?[^]+)(?[^_]+) in source

You will need to adjust the regex as I made it pretty quick and it is unlikely to match all the cases you have which you haven't provided.

Credit/Source: https://answers.splunk.com/answers/600776/multiple-fields-extractionm-using-propsconf.html

0 Karma

493669
Super Champion

can you show some sample events to understand better
from your explanation you can try:
in props.conf -

[sourcetype_name]
 REPORT-myUniqueClassName = myTransform

in transforms.conf -

[myTransform]
  REGEX = (\w+)=(\w+)
  FORMAT = $1::$2
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...