Field extraction from Windows eventlog - Splunk Community

Getting Data In

Windows eventlog are indexed fine.
A particulare evnetlog source "WinEventLog:Application Info" (mind the space) contains the normale message field.

Inside this message field I want to extra a hostname.

sourcetype="WinEventLog:Application Info" | rex field=Message "regex query"(?....) more regex" works all fine. Hostname are captured.

Now I really need this to be done from the props.conf.

I created in the props.conf

["WinEventLog:Application Info"]
EXTRACT-Hostname = same regex as above

But this doesn't seem to work? I'm I missing something?
Something wrong with the sourcetype name (mind the space)?

it seems that you have added double quotes for source so try without quotes like below:

[WinEventLog:Application Info]
EXTRACT-Hostname = <your regex>

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...