Hi All, Can any one share me a good video link explaining about Field Extraction concept on both Index time /Search time field extraction via props.conf. I had gone through the splunk documentation on field extraction method in props.conf but could not able to understand it properly and I am facing lots of problem in this area "parsing". So it will be great if any one can share a video link explaining about field Extraction and parsing.
Video Links:
1. https://www.youtube.com/watch?v=Yf5gTNiotnM
2. https://www.youtube.com/watch?v=jQ5RJRe4izM
[Links are for an older version of splunk. But refer it for clearing your concepts. ]
My favorite place is youtube. I just searched for field extraction in splunk and several short videos came up..
Hi ddrillic, thanks for your effort on this, It will be great if you can share some videos related to parsing, as I use to get most of the issues related to parsing in my organization.
thanks in advance.
Just run this simple search in youtube....
@Hemnaath, have you already checked out the following step by step documentation for Interactive Field Extraction?
Also you should try to go through Splunk Search Fundamentals 2 Course on Splunk Education. However, the same is a paid Web Based Instructor Led Training.
Hi Niketnilay, thanks for your effort on this, hey in my environment, we use to get lots of issue related to parsing and i use to go through the props.conf documentation for any parsing related issues, but I am finding it very difficult in resolving the issues tough i am reading the documents very patiently but still unable to get into it. So it will be good if i get any video on the same, any how I will go though the Interactive Field Extraction documentation again.
Meanwhile if you can share me link on the same it will be great.