Splunk Enterprise

How to use props and transform.conf in splunk

vikas_gopal
Builder

Hi Experts,

I am injecting below logs into splunk using file input.

cs2Label=Original Category Outcome cs3Label=Original Device Product cs4Label=Internal Host cs5Label=Malicious IP Address

After parsing into splunk I can see below output
cs2Label=Original
cs3Label=Original
cs4Label=Internal
cs5Label=Malicious

So from the output it is clear that it is ignoring string after first space . So I tried my own regex and place it in
transform.conf

[abc]
REGEX = (([\w.:\[\]]+)=(.*?(?=(?:\s[\w.:\[\]]+=|$))))

props.conf

[cef]
TRANSFORMS-blah = abc

Still I can see string is missing in all the fields . Please suggest how I can achieve it using props and transform conf.

Thanks
VG

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

jkat54
SplunkTrust
SplunkTrust

What is the event from? Have you tried using a TA that already has the extractions for the device? Splunk TA Cisco for example if it's a Cisco device? That's the easiest method.

0 Karma

vikas_gopal
Builder

Actually it was just for the learning purpose .I prepare a sample log and feed it to Splunk using file input.My idea was not to use TA and want to extract fields using these 2 confs . May be this TA use props and transform for extraction and I can get some help from that .

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...