I have setup a search to read a log file which is in txt format and it has various fields. What i want is when i run a search, it should give selected fields as output by reading the log file. Currently it is giving output what it is in log file as it is.
I have made changes in props.conf and transforms.conf, but still no use
transforms.conf:
FIELDS="Timestamp","Name","Success"
DELIMS=","
props.conf:
INDEXED_EXTRACTIONS = "Name of what i put in transforms.conf"
TZ = UTC
I believe INDEXED_EXTRACTIONS actually happens at input time and doesn't use transforms at all. Instead, you probably want search time extractions on your data. So try changing INDEXED_EXTRACTIONS to REPORT- in your props. For example:
Props.conf
[your_sourcetype]
REPORT-headers1 = my_sourcetype_headers
TZ = UTC
Transforms.conf
[my_sourcetype_headers]
FIELDS="Timestamp","Name","Success"
DELIMS=","