How to extract the fields from below sample output .
ONLN|2011-12-03 16:58:13.000|cmfciohqpict006|455|cmfciohqpict006|ppadmin|0|DRTB|proteus|335|system_historytmp||||informix|0|2097682|
Field Details are as below
1.Instant type
2.Date and time
3.Hostname
4.pid
5.dbservername
6.user name
7.errno
8.Event
9.Other
define a field extraction in props.conf and transforms.conf for your sourcetype
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf
by example, if your sourcetype is mysourcetype
in .../local/props.conf
[mysourcetype]
TRANSFORMS-extractmyfields=extract_mysourcetype
in .../local/transforms.conf
[extract_mysourcetype]
DELIMS = "|"
FIELDS = "InstantType","DateAndTime", "Hostname, "pid", "dbservername", "user", "name", "errno", "Event", "Other"