Splunk Search

How to extract fields from multiple file source names?

sfatnass
Contributor

Hi everybody,

I'm trying to extract fields from multiple source names.
It worked for one filename, but I have a lot of files.

It doesn't work with this example :
source::/path/*

if any body can help me thx

0 Karma
1 Solution

rdagan_splunk
Splunk Employee
Splunk Employee

Have you tried this?
[source::/path*/...]
instead of this?
[source::/path/*]

View solution in original post

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Have you tried this?
[source::/path*/...]
instead of this?
[source::/path/*]

0 Karma

sfatnass
Contributor

i resolve it by using field transform thx

for all reply ^^

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You would need to provide some values, expected result (field names and values that needs to be extracted), and your last attempted search.

0 Karma

sfatnass
Contributor

I will use regex To provide some values.
But how can i do if i have multiple source like 100000 file logs.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Still not clear to me what you're trying to do here. Do you want to setup a field extraction, in props.conf, for multiple sources? OR you're want to extract a field, from the portion of the source field value?

0 Karma

sfatnass
Contributor

I want To setup a field extraction in props.conf for multiple sources.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this should work

props.conf on Search Head

[source::/path/*]
EXTRACT-identifier=yourREGEXtoEXTRACTfield

It would be easier to set it up based on sourcetype as it's number should be low. Do these sources report on different sourcetypes?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...