I have indexed memory log files for windows. I have done the required the configuration in props.conf and transforms.conf. but only few fields are extracted and few are not. How does it happen. Either it should extract all fields or none.
Can anybody help??
Thanks in Advance.
Hi,
my suggestion is to use REGEX tool to test your extract rule first ( if you are using "EXTRACT-" or "REPORT-" to extract field).
or you can share your props.conf , transforms.conf and some sample events , we can take a look .
Hi, did you ever find a resolution to this? I am experiencing the same phenomenom in splunk 5.0.1. Some fields are being extracted properly and sometimes they are not (the same fields I mean!) Very strange.
it extract some values under _serial field, even though it is not there in transforms.conf.
Then in transforms.conf I have mentioned the fields:
[argus_extractions_win_memory]
DELIMS=","
FIELDS = Here are around 25 fields.
Only first 10 fields are extracted.
[win-memory]
REPORT-win-memory=argus_extractions_win_memory
Here is my props.conf stanza's
[source::...NT_Memory...]
sourcetype = win-memory
TRANSFORMS-null= setnull