Getting Data In

Extract fields from filename and put it into event

WXY
Path Finder

I wang to extract field from event source filename.
The file path format shows:

D:\soft\logs\fv_1_Tom_lab1_20180701.txt

I want get two fields in my events
such as username=Tom; project=lab1

what should I do ?
How can I confige my props.conf and transforms.conf ,I use SplunkForward to forward my data

0 Karma

WalshyB
Path Finder

You could try this?

props.conf
[your_sourcetype]
EXTRACT-username,project = ^.*?\logs\D+\d_(?[^]+)(?[^_]+) in source

You will need to adjust the regex as I made it pretty quick and it is unlikely to match all the cases you have which you haven't provided.

Credit/Source: https://answers.splunk.com/answers/600776/multiple-fields-extractionm-using-propsconf.html

0 Karma

493669
Super Champion

can you show some sample events to understand better
from your explanation you can try:
in props.conf -

[sourcetype_name]
 REPORT-myUniqueClassName = myTransform

in transforms.conf -

[myTransform]
  REGEX = (\w+)=(\w+)
  FORMAT = $1::$2
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...