Splunk Search

How to parse my sample raw data to so I can search for Parameter=SomeValue in Splunk?


Not exactly sure how to phrase this, but how can I remodel my data input via Splunk?

For example, my raw data looks like this:

Tag= Parameter Value =2 

Parameter = 2 in Splunk such that I can search for Parameter = Some Value

0 Karma


In your transforms.conf, add this

REGEX = Tag=\s?(\w+)\s+Value\s?=(\d+)
FORMAT = $1::$2

Here's more on how that works

0 Karma


Hey Sundaresh,

I tried this out with a restart, I didnt notice anything. Also, i added the transforms.conf under etc/system/local

Am I doing this right?

0 Karma