Splunk Search

configuring field extraction

New Member

Hi,
I want to enable automatic field extraction from header. My file looks like this format

emp|age|place

12345|28|india

how can i configure my prop.conf amd transform.conf file for this.I studied getting data manual but seems not woking for me. Can u assit me by giving me the code detail.As i am doing poc on it.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

For a search time manual field extraction with a regex.


mysearch | rex "(?[^|])\|(?[^|])\|(?[^|]*)" | table emp age place

For an automatic field extraction,

see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Extractfieldsfromfileheadersatindextime
on the search-head or indexer, define a search time field extraction for your sourcetype.
in props.conf


[mysourcetype]
TRANSFORMS-mysourcetypefields = mysourcetypefieldsextraction

in transforms.conf

[mysourcetypefieldsextraction]
FIELDS="emp", "age", "place"
DELIMS="|"

Contributor

Did you try KV_MODE = multi in props.conf (http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Propsconf) ?

0 Karma

New Member

To turn on automatic header-based field extraction for a source or source type, add CHECKFORHEADER=TRUE then [deatils]--------------sourcetype CHECKFORHEADER=TRUE
then should i give KV_MODE = multi

0 Karma

New Member

link is not opening

0 Karma