Splunk Search

configuring field extraction

New Member

I want to enable automatic field extraction from header. My file looks like this format



how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.As i am doing poc on it.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

For a search time manual field extraction with a regex.

mysearch | rex "(?[^|])\|(?[^|])\|(?[^|]*)" | table emp age place

For an automatic field extraction,

see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Extractfieldsfromfileheadersatindextime
on the search-head or indexer, define a search time field extraction for your sourcetype.
in props.conf

TRANSFORMS-mysourcetypefields = mysourcetypefieldsextraction

in transforms.conf

FIELDS="emp", "age", "place"


Did you try KV_MODE = multi in props.conf (http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Propsconf) ?

0 Karma

New Member

To turn on automatic header-based field extraction for a source or source type, add CHECKFORHEADER=TRUE then [deatils]--------------sourcetype CHECKFORHEADER=TRUE
then should i give KV_MODE = multi

0 Karma

New Member

link is not opening

0 Karma