Splunk Search

How to extract the fields in my raw event data at indexing time?

Builder

Hi,

How to extract the fields in the below Raw event using props.conf and transforms.conf

05/24/17 13:22:12 abcxyz dbmslogin_c[100]: [ddslogin.c.c][370]: [SECURITY] Successful login attempt from user kirna331 at Book12:Opennet

action=Successful
user=kirna331
src=Book12
app=Opennet

0 Karma

Path Finder

props.conf
[yourSourceType]
TRANSFORM-somename = somename

transforms.conf
[somename]
REGEX = ([^\w]+) login attempt from user ([^\w]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4

0 Karma

SplunkTrust
SplunkTrust

Try this

props.conf:

[mysourcetype]
TRANSFORM-foo = foo

transforms.conf:

[foo]
REGEX = ([^\s]+) login attempt from user ([^\s]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4
---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!