I have a Splunk event with the following lines logged from a .txt file.
HeaderField1 | HeaderField2 | HeaderField3
HeaderValue1 | HeaderValue2 | HeaderValue3
How can I manipulate the event (and future events) using configuration files (props and/or transform) so that the event text is replaced with the following extracted fields names and values:
HeaderField1 = HeaderValue1
HeaderField2 = HeaderValue2
HeaderField3 = HeaderValue3
Note: The actual header field names are always the same. The Header Values change in each text file.
I've done that in the past. The only way I could figure out to do it was to write a python script that read the file, reformatted it, and wrote the results to stdout for indexing.
That setting should be in Search Head, and will affect already indexed and future data.
Can you please share a few lines of data from your txt file and your sourcetype configuration?
@scelikokUnfortunately this did not work. The event has been logged the same and the fields were not extracted.
Hi @bartstk18,
You can use below settings in conf files,
props.conf
[txt_sourcetype]
REPORT-fieldname=field_headers
transforms.conf
[field_headers]
DELIMS = "|"
FIELDS = HeaderField1 HeaderField2 HeaderField3
If this reply helps you an upvote is appreciated.