Splunk Search

Fetching the data from the respective index of the log statement

Mubarish
Path Finder

There is a log file which has events in the following format
0|10|434d5532|xxxxxx34|2014/06/06 04:47:54|819670|3|2014/06/06 04:47:57|0|0|1|3|37905|37905|233119|0|3|0|0|0|0|xxxxxx45|xxxx.ZIP||FTP:21.345.345.45/23:234.251.35.341/25261|

This is a log format where each of the 25 fields are demilited by a pipe symbol. From the above event(s),a report needs to be created in table format.I created the report by extracting the fields first and then displayed those fields using table command.Also I can fetch the data from the respective index of the log statement, say 7th position of the event represents Servername. Apart from this way to accomplish the requirement,is there any way to create the report without using field extraction.

If the second method is feasible, can you please let me know how to fetch the data from the respective index of the log statement?

Tags (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

They are 2 methods :

see props.conf

[mysourcetype]
REPORT-extractfields=mysourcetypefiedsextraction

and transforms.conf

[mysourcetypefiedsextraction]
DELIMS="|"
FIELDS=fieldA, fieldB,fieldC
# etc....

View solution in original post

0 Karma

yannK
Splunk Employee
Splunk Employee

They are 2 methods :

see props.conf

[mysourcetype]
REPORT-extractfields=mysourcetypefiedsextraction

and transforms.conf

[mysourcetypefiedsextraction]
DELIMS="|"
FIELDS=fieldA, fieldB,fieldC
# etc....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...