Splunk Search

How to edit my props and transforms for proper extraction and output when searching select fields?

shreyasathavale
Communicator

I have setup a search to read a log file which is in txt format and it has various fields. What i want is when i run a search, it should give selected fields as output by reading the log file. Currently it is giving output what it is in log file as it is.
I have made changes in props.conf and transforms.conf, but still no use

transforms.conf:

FIELDS="Timestamp","Name","Success"
DELIMS=","

props.conf:

INDEXED_EXTRACTIONS = "Name of what i put in transforms.conf"
TZ = UTC
0 Karma

maciep
Champion

I believe INDEXED_EXTRACTIONS actually happens at input time and doesn't use transforms at all. Instead, you probably want search time extractions on your data. So try changing INDEXED_EXTRACTIONS to REPORT- in your props. For example:

Props.conf

[your_sourcetype]
REPORT-headers1 = my_sourcetype_headers
TZ = UTC

Transforms.conf

[my_sourcetype_headers]
FIELDS="Timestamp","Name","Success"
DELIMS=","
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...