Getting Data In

Prop & Transform a Sourcetype & a Sentenc

TitanAE
New Member

I have a Prop & Transform file. In it, I'm trying to parse a specific field and label it as a source type. I had it working before but now... it's a bit broken.

Transforms.conf

[audit_sourcetype_11]
REGEX = (AUDIT_Sourcetype_1)
FORMAT = sourcetype::Sourcetype_1_Name
DEST_KEY = MetaData:Sourcetype

[audit_sourcetype_22]
REGEX = (AUDIT_Sourcetype_22)
FORMAT = sourcetype::Sourcetype_2_Name
DEST_KEY = MetaData:Sourcetype

Props.conf

disabled = false
NO_BINARY_CHECK = true
disabled = false
pulldown_type = true

The other issue I'm having is that I have certain events and messages that show up like this:

[ System_Message = This is a system message ]

However Splunk parses it and displays it like this:

Field: System_Message
Value: This

How do I tell Splunk to look at the entire message. Not just the first character? In the same Transforms.conf?

0 Karma

HiroshiSatoh
Champion

It is not a configuration file of the field definition.
If the field definition is bad, why not try redefining it from the GUI?

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...