Splunk Search

How to extract the fields in my raw event data at indexing time?

kiran331
Builder

Hi,

How to extract the fields in the below Raw event using props.conf and transforms.conf

05/24/17 13:22:12 abcxyz dbmslogin_c[100]: [ddslogin.c.c][370]: [SECURITY] Successful login attempt from user kirna331 at Book12:Opennet

action=Successful
user=kirna331
src=Book12
app=Opennet

0 Karma

sravankaripe
Communicator

props.conf
[yourSourceType]
TRANSFORM-somename = somename

transforms.conf
[somename]
REGEX = ([^\w]+) login attempt from user ([^\w]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this

props.conf:

[mysourcetype]
TRANSFORM-foo = foo

transforms.conf:

[foo]
REGEX = ([^\s]+) login attempt from user ([^\s]+) at ([^:]+):(.*)
FORMAT = action=$1 user=$2 src=$3 app=$4
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...