Splunk Search

Header Field and Values

bartstk18
Loves-to-Learn Lots

I have a Splunk event with the following lines logged from a .txt file.

HeaderField1 | HeaderField2 | HeaderField3

HeaderValue1 | HeaderValue2 | HeaderValue3

How can I manipulate the event (and future events) using configuration files (props and/or transform) so that the event text is replaced with the following extracted fields names and values:

HeaderField1 = HeaderValue1

HeaderField2 = HeaderValue2

HeaderField3 = HeaderValue3

Note: The actual header field names are always the same. The Header Values change in each text file.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I've done that in the past.  The only way I could figure out to do it was to write a python script that read the file, reformatted it, and wrote the results to stdout for indexing.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

scelikok
Champion

That setting should be in Search Head, and will affect already indexed and future data.

Can you please share a few lines of data from your txt file and your sourcetype configuration?

 

If this reply helps you an upvote is appreciated.
0 Karma

bartstk18
Loves-to-Learn Lots

@scelikokUnfortunately this did not work. The event has been logged the same and the fields were not extracted.

0 Karma

scelikok
Champion

Hi @bartstk18,

You can use below settings in conf files,

 

props.conf
[txt_sourcetype]
REPORT-fieldname=field_headers

transforms.conf
[field_headers]
DELIMS = "|"
FIELDS = HeaderField1 HeaderField2 HeaderField3 

 

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma