fields.conf

fields.conf

The following are the spec and example files for fields.conf.

fields.conf.spec

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0
#
# This file contains possible attribute and value pairs for creating dynamic field extractions.
# This file contains possible attribute and value pairs for configuring additional information for fields.
# Use this file if you are creating a field at index time (not advised).
# Also, use this file to indicate that your configured field's value is a smaller part of a token.
# For example, your field's value is "123" but it occurs as "foo123" in your event.
# Configure fields.conf to:
#   * Tell Splunk how to handle multi-value fields.
#   * Distinguish indexed and extracted fields.
#   * Improve search performance by telling the search processor how to handle field values.
#
# There is a fields.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place a fields.conf in $SPLUNK_HOME/etc/system/local/.  For examples, see fields.conf.example.
# You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles

[<field name>]
* Name of the field you're configuring. 
* Follow this stanza name with any number of the following attribute/value pairs.
* Field names can only contain a-z, A-Z, 0-9, and  _, but cannot begin with a number or _

TOKENIZER = <regular expression>
* A regular expression that indicates how the field can take on multiple values at the same time.
 * Use this setting to configure multi-value fields (http://www.splunk.com/doc/current/admin/MultivalueFields).
* If empty, the field can only take on a single value. 
* Otherwise, the first group is taken from each match to form the set of values.
* This setting is used by search/where (the search command), the summary and XML outputs of the asynchronous search API, and by the top, timeline and stats commands.
* Tokenization of indexed fields (INDEXED = true) is not supported thus this attribute is ignored
* Default to empty.

INDEXED = true | false
* Indicate whether a field is indexed or not.
* Set to true if the field is indexed.
* Set to false for fields extracted at search time (the majority of fields).
* Defaults to false.

INDEXED_VALUE = true | false
* Set {{indexed_value}} to true if the value is in the raw text of the event.  
* Set it to false if the value is not in the raw text of the event.
* Setting this to true expands any search for key=value into a search of value AND key=value (since value is indexed).
* Defaults to true.
* NOTE: You only need to set indexed_value if indexed = false.

fields.conf.example

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# This file contains an example fields.conf.  Use this file to configure dynamic field extractions.
#
# To use one or more of these configurations, copy the configuration block into
# fields.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to 
# enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles
#
# The following example can be used with the IMAP bundle (found here:
# http://www.splunkbase.com/addons/All/Technologies/Mail/addon:IMAP+Addon .)
# These tokenizers result in the values of To, From and Cc treated as a list,
# where each list element is an email address found in the raw string of data.

[To]
TOKENIZER = (\w[\w.\-]*@[\w.\-]*\w)

[From]
TOKENIZER = (\w[\w.\-]*@[\w.\-]*\w)

[Cc]
TOKENIZER = (\w[\w.\-]*@[\w.\-]*\w)

• Was this topic useful?
• Post a comment