Example Splunk props + transforms

props.conf

# 2014-05-11 12:34:11,372 INFO amec.foobar.com 148.23.14.242 | action = accept | status = 200 | bytes = 235 | method = GET | request = /store/checkout?q=foo&var=123#test | custom_var = some string with a "|" in it | another_var = !@#$1234

[my_sourcetype]
# index-time settings:
# http://regex101.com/r/fX9lB1
LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} [A-Z]+
TRUNCATE = 1000
SHOULD_LINEMERGE = false
# http://regex101.com/r/lK9xB8
TIME_PREFIX = ^
# http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
# http://en.wikipedia.org/wiki/List_of_zoneinfo_timezones
TZ = GMT
ANNOTATE_PUNCT = false

# search-time settings:
# http://regex101.com/r/pC9uV5
EXTRACT-fields = (?<severity>[A-Z]+) (?<source_host>\S+) (?<ip>(?:\d{1,3}\.){3}\d{1,3}) \|
REPORT-more_fields = key_value
KV_MODE = None

transforms.conf

# This is referenced from props.conf REPORT-
[key_value]
# http://regex101.com/r/vI0pD7
REGEX = \| (?<_KEY_1>\w+) = (?<_VAL_1>.+?)(?= \| \w+ = |$)