Splunk Search

How to edit my props and transforms for proper extraction and output when searching select fields?

shreyasathavale
Communicator

I have setup a search to read a log file which is in txt format and it has various fields. What i want is when i run a search, it should give selected fields as output by reading the log file. Currently it is giving output what it is in log file as it is.
I have made changes in props.conf and transforms.conf, but still no use

transforms.conf:

FIELDS="Timestamp","Name","Success"
DELIMS=","

props.conf:

INDEXED_EXTRACTIONS = "Name of what i put in transforms.conf"
TZ = UTC
0 Karma

maciep
Champion

I believe INDEXED_EXTRACTIONS actually happens at input time and doesn't use transforms at all. Instead, you probably want search time extractions on your data. So try changing INDEXED_EXTRACTIONS to REPORT- in your props. For example:

Props.conf

[your_sourcetype]
REPORT-headers1 = my_sourcetype_headers
TZ = UTC

Transforms.conf

[my_sourcetype_headers]
FIELDS="Timestamp","Name","Success"
DELIMS=","
0 Karma