Events from Docker do not have proper field extractions

[rwardwell]

We are sending test data from a docker container to splunk via the splunk logging driver. I am able to vie the data but there is not any additional field extraction based on the sourcetype I assign, i.e. catalina, json etc. Is this something I need to change on the docker side? I have seen some references to the _raw format vs json vs inline but it did not seem like it would necessarily help.

[tgrogan_stack]

In order for any built-in field extractions to work your source data must actually be in that format. Setting the sourcetype in inputs.conf does not cause the data to be in that format.

You may need to add stanzas to props.conf and/or transforms.conf to tell Splunk how to parse events and fields.

I have, on occasion resorted to regex for field extractions at search time.

Can you provide an example of the test data you are sending to Splunk? That might help in understanding what you are sending, and therefore, what you should be telling Splunk regarding the expected format.