Getting Data In

how to get props.conf to separate unstructured data

DataOrg
Builder

i want to have 3 fileds in the below unstructured data. i need props.conf for the below data.
1st is always heading.
2nd is always paragragh words.
3rd is always URL.
and URL the first line is heading follows

Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
    Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
     “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

    Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-s...  3.>>>>> as URL field 3rd new column

    Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
    Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
    Strategy pays off
    In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
        Expansion not over yet  2.>>>>>> next text aas a word
    Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
     Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
      “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

     Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-spotlight-as-investors-continue-to-gauge-christmas-retail-results-910189.html  3.>>>>> as URL field 3rd new column

     Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
     Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
     Strategy pays off
     In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
         Expansion not over yet  2.>>>>>> next text aas a word
     Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field" 
| rex max_match=0 "(?m)(?<lines>(?!^\s+$)^.+$)" 
| eval counter=mvrange(0,mvcount(lines)), counter=mvzip(counter,lines) 
| stats count by counter
| rename counter as _raw 
| sort _raw 
| streamstats current=f count(eval(searchmatch("Link:"))) as session
| stats first(_raw) as subject last(_raw) as link list(_raw) as msg by session
| eval message=mvindex(msg,1,-2)
| table subject message link
| foreach *
    [eval <<FIELD>> = mvmap(<<FIELD>>,replace(<<FIELD>>,"\d,\s+",""))] 
| nomv message

This is Just sample, sorry I don't know props.conf
When can't create props.conf, please use collect and index your_summary_index

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
     Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
      “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

     Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-spotlight-as-investors-continue-to-gauge-christmas-retail-results-910189.html  3.>>>>> as URL field 3rd new column

     Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
     Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
     Strategy pays off
     In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
         Expansion not over yet  2.>>>>>> next text aas a word
     Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field" 
| rex max_match=0 "(?m)(?<lines>(?!^\s+$)^.+$)" 
| eval counter=mvrange(0,mvcount(lines)), counter=mvzip(counter,lines) 
| stats count by counter
| rename counter as _raw 
| sort _raw 
| streamstats current=f count(eval(searchmatch("Link:"))) as session
| stats first(_raw) as subject last(_raw) as link list(_raw) as msg by session
| eval message=mvindex(msg,1,-2)
| table subject message link
| foreach *
    [eval <<FIELD>> = mvmap(<<FIELD>>,replace(<<FIELD>>,"\d,\s+",""))] 
| nomv message

This is Just sample, sorry I don't know props.conf
When can't create props.conf, please use collect and index your_summary_index

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...