Getting Data In

how to get props.conf to separate unstructured data

DataOrg
Builder

i want to have 3 fileds in the below unstructured data. i need props.conf for the below data.
1st is always heading.
2nd is always paragragh words.
3rd is always URL.
and URL the first line is heading follows

Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
    Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
     “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

    Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-s...  3.>>>>> as URL field 3rd new column

    Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
    Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
    Strategy pays off
    In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
        Expansion not over yet  2.>>>>>> next text aas a word
    Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
     Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
      “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

     Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-spotlight-as-investors-continue-to-gauge-christmas-retail-results-910189.html  3.>>>>> as URL field 3rd new column

     Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
     Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
     Strategy pays off
     In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
         Expansion not over yet  2.>>>>>> next text aas a word
     Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field" 
| rex max_match=0 "(?m)(?<lines>(?!^\s+$)^.+$)" 
| eval counter=mvrange(0,mvcount(lines)), counter=mvzip(counter,lines) 
| stats count by counter
| rename counter as _raw 
| sort _raw 
| streamstats current=f count(eval(searchmatch("Link:"))) as session
| stats first(_raw) as subject last(_raw) as link list(_raw) as msg by session
| eval message=mvindex(msg,1,-2)
| table subject message link
| foreach *
    [eval <<FIELD>> = mvmap(<<FIELD>>,replace(<<FIELD>>,"\d,\s+",""))] 
| nomv message

This is Just sample, sorry I don't know props.conf
When can't create props.conf, please use collect and index your_summary_index

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw=" Tesco and Marks & Spencer set for market spotlight as investors continue to gauge Christmas retail results 1. ----> **first Line is in first new column**
     Whether or not there are any more acquisition stories, food retail will be very much in focus on Thursday as Tesco and M&S release Christmas trading updates.
      “slightly” higher than expectations thanks to a variety of factors, including its opinion splitting vegan products.   2.>>>>>> next text aas a word 2nd column

     Link: https://www.proactiveinvestors.co.uk/companies/news/910189/tesco-and-marks--spencer-set-for-market-spotlight-as-investors-continue-to-gauge-christmas-retail-results-910189.html  3.>>>>> as URL field 3rd new column

     Lidl plans 50 new stores a year in France   1. ----> **first Line is in new field**
     Between 2010 and 2018, Lidl saw its market share in France rise steadily to more than 6 %. The discounter is not satisfied yet however, and aims to open dozens of new stores every year in the foreseeable future.
     Strategy pays off
     In 2012, Lidl changed its strategy in France radically: since then, the discounter invested a whopping 4.5 billion euros in expanding its stores, but barely changed its product range. As a reward, last year the chain passed the 6 % market share milestone and has, according to Kantar, already moved up to 6.2 %. In the past decade, the turnover increased by 4.5 % each year.
         Expansion not over yet  2.>>>>>> next text aas a word
     Link: https://www.retaildetail.eu/en/news/food/lidl-plans-50-new-stores-year-france 3.>>>>> as URL field" 
| rex max_match=0 "(?m)(?<lines>(?!^\s+$)^.+$)" 
| eval counter=mvrange(0,mvcount(lines)), counter=mvzip(counter,lines) 
| stats count by counter
| rename counter as _raw 
| sort _raw 
| streamstats current=f count(eval(searchmatch("Link:"))) as session
| stats first(_raw) as subject last(_raw) as link list(_raw) as msg by session
| eval message=mvindex(msg,1,-2)
| table subject message link
| foreach *
    [eval <<FIELD>> = mvmap(<<FIELD>>,replace(<<FIELD>>,"\d,\s+",""))] 
| nomv message

This is Just sample, sorry I don't know props.conf
When can't create props.conf, please use collect and index your_summary_index

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...