bokamba / logforge / to / Splunk

$ logforge --to splunk

Generate a Splunk parser from log samples

Generate a Splunk field extraction from raw log samples — free, in your browser, no data leaves your machine. Paste a few real lines and LogForge hands back a props.conf EXTRACT- stanza with PCRE named-capture groups, plus a copy-pasteable `| rex` search you can test in Splunk straight away. Splunk’s regex engine is PCRE and supports `(?<name>…)` as-is, so the extraction the tool shows is exactly what Splunk runs.

Paste your logs → Splunk output

How it works

  1. 1

    Paste real Splunk-bound log lines — the more varied, the better the tool can tell which fields vary from which are constant.

  2. 2

    LogForge detects the fields and builds a search-time EXTRACT- stanza for props.conf under your sourcetype, using PCRE named groups.

  3. 3

    Copy the props.conf block, or run the generated `| rex field=_raw "…"` search first to confirm every field is captured before you deploy.

Detection and generation run entirely as JavaScript in your browser — there is no parsing server, and your log lines are never uploaded. See the privacy page to verify it with the Network tab.

Example: Splunk props.conf field extraction from an nginx line

These two nginx access lines are fed verbatim into the engine, and the Splunk tab produces the Splunk config below — the same output you get by pasting your own lines. 

203.0.113.45 - - [03/Jul/2026:14:22:15 +0300] "GET /api/health HTTP/1.1" 200 2 "-" "kube-probe/1.29"
198.51.100.23 - - [03/Jul/2026:14:22:19 +0300] "POST /login HTTP/1.1" 401 231 "https://example.com/" "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"

LogForge generates:

# props.conf  (search-time extraction)
[<REPLACE_WITH_SOURCETYPE>]
EXTRACT-logforge = (?<ip1>\d{1,3}(?:\.\d{1,3}){3}) - - \[(?<timestamp>\d+/[A-Za-z]+/\d+:\d+:\d+:\d+ \+\d+)\] "(?<method>[^"]*) (?<path>(?:/[^\s"']*|[A-Za-z]:[^\s"']*)) HTTP/1\.1" (?<status>\d{3}) (?<number>-?\d+(?:\.\d+)?) "(?<url>[^"]*)" "(?<user_agent>[^"]*)"

# Quick search-time test in SPL:
# | rex field=_raw "(?<ip1>\\d{1,3}(?:\\.\\d{1,3}){3}) - - \\[(?<timestamp>\\d+/[A-Za-z]+/\\d+:\\d+:\\d+:\\d+ \\+\\d+)\\] \"(?<method>[^\"]*) (?<path>(?:/[^\\s\"']*|[A-Za-z]:[^\\s\"']*)) HTTP/1\\.1\" (?<status>\\d{3}) (?<number>-?\\d+(?:\\.\\d+)?) \"(?<url>[^\"]*)\" \"(?<user_agent>[^\"]*)\""
  • note regex: the message tail diverges across lines and could not be split into stable fields — the trailing per-token literal group(s) are positional word-slices of that unstructured message, not stable fields
  • note EXTRACT-<class> names must be unique within a sourcetype stanza — rename EXTRACT-logforge if you already use that class for this sourcetype
  • note a timestamp field was detected: this EXTRACT only makes it a searchable field. To set the event _time at index time, add TIME_PREFIX and TIME_FORMAT to this props.conf stanza (TIME_FORMAT uses Splunk strptime, e.g. %Y-%m-%dT%H:%M:%S) — this generator does not guess the strptime format.

Try it on your own logs

Paste a few real lines, review the detected fields, and copy the Splunk config from the Splunk tab. Free, no account, nothing uploaded — it all runs in your browser.

Open LogForge on the Splunk tab →

Generate for other platforms

LogForge also emits regex, Grok, Wazuh decoders and rsyslog templates — see how each format is built in the docs, or browse worked examples by log source. Then open the tool and paste your own lines.