How to extract the fields in my raw event data at indexing time?

Hi, How to extract the fields in the below Raw event using props.conf and transforms.conf 05/24/17 13:22:12 abcxyz dbmslogin_c[100]: [ddslogin.c.c][370]: [SECURITY] **Successful** login attempt from user **kirna331** at **Book12**:**Opennet** action=Successful user=kirna331 src=Book12 app=Opennet