Getting Data In

Extract fields from filename and put it into event

WXY
Path Finder

I wang to extract field from event source filename.
The file path format shows:

D:\soft\logs\fv_1_Tom_lab1_20180701.txt

I want get two fields in my events
such as username=Tom; project=lab1

what should I do ?
How can I confige my props.conf and transforms.conf ,I use SplunkForward to forward my data

0 Karma

WalshyB
Path Finder

You could try this?

props.conf
[your_sourcetype]
EXTRACT-username,project = ^.*?\logs\D+\d_(?[^]+)(?[^_]+) in source

You will need to adjust the regex as I made it pretty quick and it is unlikely to match all the cases you have which you haven't provided.

Credit/Source: https://answers.splunk.com/answers/600776/multiple-fields-extractionm-using-propsconf.html

0 Karma

493669
Super Champion

can you show some sample events to understand better
from your explanation you can try:
in props.conf -

[sourcetype_name]
 REPORT-myUniqueClassName = myTransform

in transforms.conf -

[myTransform]
  REGEX = (\w+)=(\w+)
  FORMAT = $1::$2
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...