Getting Data In

breaking down segments of events



I need to break down my event logs.
I'm getting confused in configuring transform.conf, props.conf, etc...

this a sample of one line of my data:

I, [2011-04-01T00:01:04.883503 #1023]  INFO -- : [2011-04-01 00:01:03,,12345,,654,,MX,IN]

(for confidentiality reasons, I've changed data values... but the format follows the same)

so currently, splunk is able to map the source ip, and also identifies the time.

I want to break down all the rest of the event as well based on resource records (MX, A, AAAA, etc.), domains, etc..
firstly, Can I do that from splunk manager? probably "Manager>fiels"...
if not, can you guide me through configuring the conf files..

thank you.

0 Karma

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.