Splunk Search
Highlighted

How to extract the fields in my raw event data at indexing time?

Builder

Hi,

How to extract the fields in the below Raw event using props.conf and transforms.conf

05/24/17 13:22:12 abcxyz dbmslogin_c[100]: [ddslogin.c.c][370]: [SECURITY] Successful login attempt from user kirna331 at Book12:Opennet

action=Successful
user=kirna331
src=Book12
app=Opennet

0 Karma
Highlighted

Re: How to extract the fields in my raw event data at indexing time?

SplunkTrust
SplunkTrust

Try this

props.conf:

[mysourcetype]
TRANSFORM-foo = foo

transforms.conf:

[foo]
REGEX = ([^\s]+) login attempt from user ([^\s]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to extract the fields in my raw event data at indexing time?

Path Finder

props.conf
[yourSourceType]
TRANSFORM-somename = somename

transforms.conf
[somename]
REGEX = ([^\w]+) login attempt from user ([^\w]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4

0 Karma