breaking down segments of events

[nina15]

hi...

I need to break down my event logs.
I'm getting confused in configuring transform.conf, props.conf, etc...

this a sample of one line of my data:

I, [2011-04-01T00:01:04.883503 #1023]  INFO -- : [2011-04-01 00:01:03,153.30.11.29,12345,192.225.180.55,654,bumiflow.com.my,MX,IN]

(for confidentiality reasons, I've changed data values... but the format follows the same)

so currently, splunk is able to map the source ip, and also identifies the time.

I want to break down all the rest of the event as well based on resource records (MX, A, AAAA, etc.), domains, etc..
firstly, Can I do that from splunk manager? probably "Manager>fiels"...
if not, can you guide me through configuring the conf files..

thank you.

[ignetops]

I would simply do field extractions or define event types from a search in the Search app.

http://docs.splunk.com/Documentation/Splunk/4.2.4/knowledge/Defineeventtypes http://docs.splunk.com/Documentation/Splunk/4.2.4/User/ExtractNewFields