Splunk Search

How to edit my props and transforms for proper extraction and output when searching select fields?

shreyasathavale
Communicator

I have setup a search to read a log file which is in txt format and it has various fields. What i want is when i run a search, it should give selected fields as output by reading the log file. Currently it is giving output what it is in log file as it is.
I have made changes in props.conf and transforms.conf, but still no use

transforms.conf:

FIELDS="Timestamp","Name","Success"
DELIMS=","

props.conf:

INDEXED_EXTRACTIONS = "Name of what i put in transforms.conf"
TZ = UTC
0 Karma

maciep
Champion

I believe INDEXED_EXTRACTIONS actually happens at input time and doesn't use transforms at all. Instead, you probably want search time extractions on your data. So try changing INDEXED_EXTRACTIONS to REPORT- in your props. For example:

Props.conf

[your_sourcetype]
REPORT-headers1 = my_sourcetype_headers
TZ = UTC

Transforms.conf

[my_sourcetype_headers]
FIELDS="Timestamp","Name","Success"
DELIMS=","
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...