I have the infra as shown below:
Splunk Log Forwarder-> Splunk Indexer
The Log forwarder defines which data goes into which index, which is configured at Log Forwarder, Data Input -> Files/Directories.
The data(email text file) goes into the directory , then the forwarder forwards to the correct index.
Note: Email texts do not conform to any Common Information Model, when it goes into splunk indexer, it will be just text.
At the Log forwarder, there is a list of props.conf and transforms.conf to tell it how to look for regexp and extract the fields .
However, if new content and regexp changes, it will not be able to detect it.
Is there any intelligent way to know what fields to extract the fields(if the lines have this format xxxx followed by semi colon)
eg. Sent: Feb 19 2019 10:00 -> reported_time(field): Feb 19 2019 10:00
Reported issue: issue1-> reported_issue(field): issue1
user:xxx -> affected_user(field): user
Is this the correct way to extract the fields at the log forwarder?
Or it could be done at the Indexer, so that if the regexp changes, I just need to update, and the fields will be re-extracted accordingly.
