Getting Data In

Extract fields from filename and put it into event

WXY
Path Finder

I wang to extract field from event source filename.
The file path format shows:

D:\soft\logs\fv_1_Tom_lab1_20180701.txt

I want get two fields in my events
such as username=Tom; project=lab1

what should I do ?
How can I confige my props.conf and transforms.conf ,I use SplunkForward to forward my data

0 Karma

WalshyB
Path Finder

You could try this?

props.conf
[your_sourcetype]
EXTRACT-username,project = ^.*?\logs\D+\d_(?[^]+)(?[^_]+) in source

You will need to adjust the regex as I made it pretty quick and it is unlikely to match all the cases you have which you haven't provided.

Credit/Source: https://answers.splunk.com/answers/600776/multiple-fields-extractionm-using-propsconf.html

0 Karma

493669
Super Champion

can you show some sample events to understand better
from your explanation you can try:
in props.conf -

[sourcetype_name]
 REPORT-myUniqueClassName = myTransform

in transforms.conf -

[myTransform]
  REGEX = (\w+)=(\w+)
  FORMAT = $1::$2
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...