Getting Data In

breaking down segments of events



I need to break down my event logs.
I'm getting confused in configuring transform.conf, props.conf, etc...

this a sample of one line of my data:

I, [2011-04-01T00:01:04.883503 #1023]  INFO -- : [2011-04-01 00:01:03,,12345,,654,,MX,IN]

(for confidentiality reasons, I've changed data values... but the format follows the same)

so currently, splunk is able to map the source ip, and also identifies the time.

I want to break down all the rest of the event as well based on resource records (MX, A, AAAA, etc.), domains, etc..
firstly, Can I do that from splunk manager? probably "Manager>fiels"...
if not, can you guide me through configuring the conf files..

thank you.

0 Karma

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!