Fetching the data from the respective index of the log statement

[Mubarish]

There is a log file which has events in the following format
0|10|434d5532|xxxxxx34|2014/06/06 04:47:54|819670|3|2014/06/06 04:47:57|0|0|1|3|37905|37905|233119|0|3|0|0|0|0|xxxxxx45|xxxx.ZIP||FTP:21.345.345.45/23:234.251.35.341/25261|

This is a log format where each of the 25 fields are demilited by a pipe symbol. From the above event(s),a report needs to be created in table format.I created the report by extracting the fields first and then displayed those fields using table command.Also I can fetch the data from the respective index of the log statement, say 7th position of the event represents Servername. Apart from this way to accomplish the requirement,is there any way to create the report without using field extraction.

If the second method is feasible, can you please let me know how to fetch the data from the respective index of the log statement?

[yannK · Accepted solution]

They are 2 methods :

• If your logs have a header with a list of the columns names, you can use index time header extractions
  http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime

• If you want to to is manually, from the search-head you can define a search time field extraction with a delimitor and a static list of fields.
  http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/Createandmaintainsearch-timefieldextract...

see props.conf

[mysourcetype]
REPORT-extractfields=mysourcetypefiedsextraction


and transforms.conf

[mysourcetypefiedsextraction]
DELIMS="|"
FIELDS=fieldA, fieldB,fieldC
# etc....