fields.conf

fields.conf

Add entries to fields.conf for any fields you create.

fields.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.2
#
# This file contains possible attribute and value pairs for creating dynamic field extractions.
# There is a fields.conf in $SPLUNK_HOME/etc/bundles/default/.  To set custom configurations, 
# place a fields.conf in your own custom bundle directory.
#
# splunkd must be restarted when you make changes.  
# A configuration looks like:
[<field name>]
TOKENIZER = ^\s+(.+?)(\s+|$)
INDEXED = False
INDEXED_VALUE = True
TOKENIZER = <regular expression>
  	* A regular expression that indicates how the field can take on multiple values at the same time. 
  	* If empty, the field can only take on a single value. 
  	* Otherwise, the first group is taken from each match to form the set of values.
  	* This feature is used by search/where (the search command), the summary and XML outputs of the 
    asynchronous search API, and by the top, timeline and stats commands.
    * Default to empty.
INDEXED = <true | false>
  	* Indicates that this field can be found in the index as fieldname::value.
    * Set to true if you want the field to appear in the "fields" drop-down in SplunkWeb.
    * Defaults to false.
INDEXED_VALUE = <true | false>
  	* Indicates that specific values of this field are searchable in the index.
    * Setting this to true expands any search for key=value into a search of value AND key=value
      (since value is indexed).
    * Defaults to true.

fields.conf.example

# This file contains an example fields.conf.  Use this file to configure dynamic field extractions.
#
# To use one or more of these configurations, copy the configuration block into
# fields.conf in your own custom bundle.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
#
# The following example can be used with the IMAP bundle (found here:
# http://www.splunkbase.com/addons/All/Technologies/Mail/addon:IMAP+Addon .)
# These tokenizers result in the values of To, From and Cc treated as a list,
# where each list element is an email address found in the raw string of data.
[To]
TOKENIZER = (\w[\w.\-]*@[\w.\-]*\w)
[From]
TOKENIZER = (\w[\w.\-]*@[\w.\-]*\w)
[Cc]
TOKENIZER = (\w[\w.\-]*@[\w.\-]*\w)

• Was this topic useful?
• Post a comment