Data example and setting method

Data format: As shown below, both A and B format events exist in the same source.

A: Date and time A item B item C item D item E item
B: Date and time A item D item E item

Let's say we want to capture this data as source type: sample.

Setup steps

* Edit the configuration file under $SPLUNK_HOME/etc/<any app>/local.

• Set regular expressions in transforms.conf so that fields can be extracted in both cases A and B.

For A, the field is extracted in the following typeA format according to the format, and for B as well, the field is extracted in the following typeB format according to the format.

Setting Example:

[typeA]
REGEX = ^[^\s]+\s[^\s]+\s(?[^\s]*)\s(?[^\s]*)\s(?[^\s]*)
\s(?[^\s]*)\s(?[^\s]*)$

[typeB]
REGEX = ^[^\s]+\s[^\s]+\s(?[^\s]*)\s(?[^\s]*)\s(?[^\s]*)$

• Set two REPORTs for one source type in props.conf.

Setting Example:

[sample]
REPORT-sample = typeA,typeB

* The stanza name such as sourcetype is written in []. Let REPORT-<unique class name> = <stanza name set in transforms.conf>.