source = D:\Users\ABC\Desktop\splunk\abc.log
I have extracted the part of string I wanted using (?\w+\.\w+). My sourcetype=log4j
What changes need to be made in props.conf and transforms.conf so that it can reflect in Splunk?
For search-time extractions add this to your props.conf
EXTRACT-my_ext = your_regex
Hope it helps.