Getting Data In

Field extraction from Windows eventlog

New Member

Windows eventlog are indexed fine.
A particulare evnetlog source "WinEventLog:Application Info" (mind the space) contains the normale message field.

Inside this message field I want to extra a hostname.

sourcetype="WinEventLog:Application Info" | rex field=Message "regex query"(?....) more regex" works all fine. Hostname are captured.

Now I really need this to be done from the props.conf.

I created in the props.conf

["WinEventLog:Application Info"]
EXTRACT-Hostname = same regex as above

But this doesn't seem to work? I'm I missing something?
Something wrong with the sourcetype name (mind the space)?

Tags (1)
0 Karma

Super Champion

it seems that you have added double quotes for source so try without quotes like below:

[WinEventLog:Application Info]
EXTRACT-Hostname = <your regex>
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...