Splunk Search

Field extraction using props.conf and transforms.conf

mihirpradhan
Explorer

Hello,

This is what my field extraction looks like in the GUI:
Name- source::/home/user/logs/* : EXTRACT-request_id
Type- Inline
Extraction/Transform- Request\sID:\s(?P<request_id>[0-9a-zA-Z\:\.\-\@]+)
App- search

What is the best way to configure props.conf and transforms.conf for this change? What content do I need to add to both files?

Thanks

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...