Getting Data In

how to get props.conf to separate unstructured data

DataOrg
Builder

i want to have 3 fileds in the below unstructured data. i need props.conf for the below data.
1st is always heading.
2nd is always paragragh words.
3rd is always URL.
and URL the first line is heading follows

Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
    Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
     “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

    Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-s...  3.>>>>> as URL field 3rd new column

    Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
    Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
    Strategy pays off
    In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
        Expansion not over yet  2.>>>>>> next text aas a word
    Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
     Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
      “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

     Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-spotlight-as-investors-continue-to-gauge-christmas-retail-results-910189.html  3.>>>>> as URL field 3rd new column

     Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
     Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
     Strategy pays off
     In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
         Expansion not over yet  2.>>>>>> next text aas a word
     Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field" 
| rex max_match=0 "(?m)(?<lines>(?!^\s+$)^.+$)" 
| eval counter=mvrange(0,mvcount(lines)), counter=mvzip(counter,lines) 
| stats count by counter
| rename counter as _raw 
| sort _raw 
| streamstats current=f count(eval(searchmatch("Link:"))) as session
| stats first(_raw) as subject last(_raw) as link list(_raw) as msg by session
| eval message=mvindex(msg,1,-2)
| table subject message link
| foreach *
    [eval <<FIELD>> = mvmap(<<FIELD>>,replace(<<FIELD>>,"\d,\s+",""))] 
| nomv message

This is Just sample, sorry I don't know props.conf
When can't create props.conf, please use collect and index your_summary_index

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
     Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
      “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

     Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-spotlight-as-investors-continue-to-gauge-christmas-retail-results-910189.html  3.>>>>> as URL field 3rd new column

     Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
     Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
     Strategy pays off
     In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
         Expansion not over yet  2.>>>>>> next text aas a word
     Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field" 
| rex max_match=0 "(?m)(?<lines>(?!^\s+$)^.+$)" 
| eval counter=mvrange(0,mvcount(lines)), counter=mvzip(counter,lines) 
| stats count by counter
| rename counter as _raw 
| sort _raw 
| streamstats current=f count(eval(searchmatch("Link:"))) as session
| stats first(_raw) as subject last(_raw) as link list(_raw) as msg by session
| eval message=mvindex(msg,1,-2)
| table subject message link
| foreach *
    [eval <<FIELD>> = mvmap(<<FIELD>>,replace(<<FIELD>>,"\d,\s+",""))] 
| nomv message

This is Just sample, sorry I don't know props.conf
When can't create props.conf, please use collect and index your_summary_index

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...