How do I tell splunk that a particular source_type should have specific extract command parameters applied so as to correctly split the data into key & value? This is for ease of searching by users so that they don't have to know how how to get the fields out: they should just be there ready for them use.
Specifically, I have some simple log files that contain a single line of json text. There is only one level of "key"=>"value" in the file.
eg
{"host"=>"db1.blah", "app"=>"myapp"}
The following extract command (at search time) simply parses the key=>values and makes search time fields out of them.
host=* index=json_logs | extract kvdelim="=>" pairdelim=","
My question is, how do it tell splunk to automatically kv extract this source type. So that an end user can simply type
host=* index=json_logs | search host=db1.blah
All of our other indexes have search time extractions via regexes and our users are used to simply getting the data in a format that is pre-field-extracted as much as possible. So they can focus on the problem and less on the parsing.
Thanks for considering this problem.
