Hi,
new to Splunk and would like to use it to parse application logs where every log entries is in the format shown below.
When I select and ThreadId, I would like to keep only the following fields:
Timestamp, Message, Title, ProcessId and ThreadId.
and eliminate the rest of the fields.
Timestamp: 8/16/2013 3:48:41 PM
Message: Starting main
Category: Trace
Priority: 0
EventId: 0
Severity: Start
Title:
Machine:
Application Domain: Foo.exe
Process Id: 6824
Process Name: C:\App\Foo.exe
Win32 Thread Id: 6348
Thread Name:
Extended Properties:
How Can this be accomplished?
Thanks,
Jm
... View more