Im new to splunk and just started learning it and im having little issues extracting some fields from a raw data
ex: of Ram Data
04/12 15:50:38 [LOGON]  Domain: SamLogon: Network logon of Domain\test1$ from machine1 Returns 0xC0000064
I would like to extract the following
SamLogon : Network logon of Domain\test1$ from machine1
Returns : 0xC0000064
im trying to use the regex in props.conf in SH
Any help would be appreciated . Thanks
I'm trying to use the regex in props.conf in SH
You're probably using it as a standalone,
EXTRACT-fields = SamLogon: (?<Samlogon>.*) Returns (?<Returns>\S+)
Run your search as you have it, pipe your results to erex (may favorite hidden gem in Splunk).
The first "SamLogon" value is what you name the field, it's arbitrary. The second is the value that Splunk searches for.
Run the search, the examine the Job Inpspector, it will provide the regex that Splunk used to find the value.
You can fine tune it from there, but it is a fantastic starting point...
| erex SamLogon examples="SamLogon"
Can you share what you've tried in props.conf?
How fixed is the data you're parsing? Are there any pieces of text a regular expression can key on?