Splunk Search

How to extract fields from multiple file source names?

Contributor

Hi everybody,

I'm trying to extract fields from multiple source names.
It worked for one filename, but I have a lot of files.

It doesn't work with this example :
source::/path/*

if any body can help me thx

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Have you tried this?
[source::/path/...]
instead of this?
[source::/path/
]

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Have you tried this?
[source::/path/...]
instead of this?
[source::/path/
]

View solution in original post

0 Karma

Contributor

i resolve it by using field transform thx

for all reply ^^

0 Karma

SplunkTrust
SplunkTrust

You would need to provide some values, expected result (field names and values that needs to be extracted), and your last attempted search.

0 Karma

Contributor

I will use regex To provide some values.
But how can i do if i have multiple source like 100000 file logs.

0 Karma

SplunkTrust
SplunkTrust

Still not clear to me what you're trying to do here. Do you want to setup a field extraction, in props.conf, for multiple sources? OR you're want to extract a field, from the portion of the source field value?

0 Karma

Contributor

I want To setup a field extraction in props.conf for multiple sources.

0 Karma

SplunkTrust
SplunkTrust

Something like this should work

props.conf on Search Head

[source::/path/*]
EXTRACT-identifier=yourREGEXtoEXTRACTfield

It would be easier to set it up based on sourcetype as it's number should be low. Do these sources report on different sourcetypes?

0 Karma