errpt splunk the easy way

gistfile1.txt

errnotify:
    en_name = "splunk_errpt"
    en_persistenceflg = 0
    en_method = "errpt -a -l $1 >/opt/splunkforwarder/etc/apps/TA-errpt/var/errpt/$$.errpt"

[batch://$SPLUNK_HOME/etc/apps/TA-errpt/var/errpt]
move_policy = sinkhole
sourcetype = errpt
source = errpt
index = unix_idx
recursive = false
disabled = 0

[errpt]
TIME_PREFIX = Date\/Time\:\s+
TIME_FORMAT = %a %b %d %k:%M:%S %Y
MAX_TIMESTAMP_LOOKAHEAD = 24
TZ = CST
LINE_BREAKER = (\-{9,})
BREAK_ONLY_BEFORE_DATE = false
LOOKUP-errptfscsi = errptfscsi fscsi_errcode OUTPUT fscsi_errdesc
LOOKUP-errpt = errpt errpt_identifier OUTPUT errpt_description
EXTRACT-errpt_label = (?i)LABEL:\s+(?P<errpt_label>\S+)
EXTRACT-errpt_identifier = (?i)IDENTIFIER:\s+(?P<errpt_identifier>\S+)
EXTRACT-errpt_type = (?i)TYPE:\s+(?P<errpt_type>\S+)
EXTRACT-errpt_class = (?i)CLASS:\s+(?P<errpt_class>\S+)
EXTRACT-fscsi_errcode = (?i)(?<=(SENSE\sDATA\s\w{4}\s\w{4}\s))(?P<fscsi_errcode>\w{4}\s\w{4})
EXTRACT-errpt_res_name = (?i)Resource\s+Name:\s+(?<errpt_res_name>\S+)