How to extract fields from multiple file source names?

[sfatnass]

Hi everybody,

I'm trying to extract fields from multiple source names.
It worked for one filename, but I have a lot of files.

It doesn't work with this example :
source::/path/*

if any body can help me thx

[rdagan_splunk · Accepted solution]

Have you tried this?
[source::/path*/...]
instead of this?
[source::/path/*]

[sfatnass]

i resolve it by using field transform thx

for all reply ^^

[somesoni2]

You would need to provide some values, expected result (field names and values that needs to be extracted), and your last attempted search.

[sfatnass]

I will use regex To provide some values.
But how can i do if i have multiple source like 100000 file logs.

[somesoni2]

Still not clear to me what you're trying to do here. Do you want to setup a field extraction, in props.conf, for multiple sources? OR you're want to extract a field, from the portion of the source field value?

[sfatnass]

I want To setup a field extraction in props.conf for multiple sources.

[somesoni2]

Something like this should work

props.conf on Search Head

[source::/path/*]
EXTRACT-identifier=yourREGEXtoEXTRACTfield

It would be easier to set it up based on sourcetype as it's number should be low. Do these sources report on different sourcetypes?