Splunk Search

How to edit my props and transforms for proper extraction and output when searching select fields?

shreyasathavale
Communicator

I have setup a search to read a log file which is in txt format and it has various fields. What i want is when i run a search, it should give selected fields as output by reading the log file. Currently it is giving output what it is in log file as it is.
I have made changes in props.conf and transforms.conf, but still no use

transforms.conf:

FIELDS="Timestamp","Name","Success"
DELIMS=","

props.conf:

INDEXED_EXTRACTIONS = "Name of what i put in transforms.conf"
TZ = UTC
0 Karma

maciep
Champion

I believe INDEXED_EXTRACTIONS actually happens at input time and doesn't use transforms at all. Instead, you probably want search time extractions on your data. So try changing INDEXED_EXTRACTIONS to REPORT- in your props. For example:

Props.conf

[your_sourcetype]
REPORT-headers1 = my_sourcetype_headers
TZ = UTC

Transforms.conf

[my_sourcetype_headers]
FIELDS="Timestamp","Name","Success"
DELIMS=","
0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...