sample data :
Number: 152119522 Date : 12/01/2015 12:00:00 AM, Execution Time: 1945 Area Code: 21 Area Name: reading Road: 7789 Code: 230 Description: Backup Failed
I have successfully - managed to extract required fields individually but trying to do it another way using the colon as a delimiter but i cannot get it working - config files :
[sourcetype] TRANSFORMS-colons = colons transforms.conf [colons] REGEX = (?<_KEY_1>\w+):\s+(?<_VAL_1>\S+)
where am i going wrong - cheers.
This should be possible. I have a go with your data using this in
[test-ext] TRUNCATE = 0 SHOULD_LINEMERGE = false LINE_BREAKER = (NULL) DATETIME_CONFIG = CURRENT MAX_EVENTS = 100000 REPORT-test-ext = sourcetype-test-ext
You'd need to change the
LINE_BREAKER to whatever works best for you. This was just for a quick test.
Also, if you want to use the Date from your data as the Index time, then take a look at the
[sourcetype-test-ext] REGEX = ([^:]+):\s([^\r\n,]+) FORMAT = $1::$2
Which gives me this in Splunk:
Hopefully that gets you closer to what you're looking for.