Schema.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!--
 Licensed to the Apache Software Foundation (ASF) under one or more
 contributor license agreements.  See the NOTICE file distributed with
 this work for additional information regarding copyright ownership.
 The ASF licenses this file to You under the Apache License, Version 2.0
 (the "License"); you may not use this file except in compliance with
 the License.  You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-->

<!--
 This is the Solr schema file. This file should be named "schema.xml" and
 should be in the conf directory under the solr home
 (i.e. ./solr/conf/schema.xml by default)
 or located where the classloader for the Solr webapp can find it.

 This example schema is the recommended starting point for users.
 It should be kept correct and concise, usable out-of-the-box.

 For more information, on how to customize this file, please see
 http://wiki.apache.org/solr/SchemaXml
-->

<schema name="example" version="1.1">
  <!-- attribute "name" is the name of this schema and is only used for display purposes.
       Applications should change this to reflect the nature of the search collection.
       version="1.1" is Solr's version number for the schema syntax and semantics.  It should
       not normally be changed by applications.
       1.0: multiValued attribute did not exist, all fields are multiValued by nature
       1.1: multiValued attribute introduced, false by default -->

  <types>
    <!-- field type definitions. The "name" attribute is
       just a label to be used by field definitions.  The "class"
       attribute and any other attributes determine the real
       behavior of the fieldType.
         Class names starting with "solr" refer to java classes in the
       org.apache.solr.analysis package.
    -->

    <!-- The StrField type is not analyzed, but indexed/stored verbatim.-->
    <fieldType name="string" class="solr.TextField" sortMissingLast="true" omitNorms="true">
    	 <analyzer>
         <tokenizer class="solr.StandardTokenizerFactory"/>
	 </analyzer>
    </fieldType>

  </types>


 <fields>

   <field name="ACCESSES" type="string" indexed="true" stored="true"/>
   <field name="CLIENT" type="string" indexed="true" stored="true"/>
   <field name="DOMAIN" type="string" indexed="true" stored="true"/>
   <field name="D_TIME" type="string" indexed="true" stored="true"/>
   <field name="EVENTID" type="string" indexed="true" stored="true"/>
   <field name="E_TIME" type="string" indexed="true" stored="true"/>
   <field name="FACILITY" type="string" indexed="true" stored="true"/>
   <field name="GROUPNAME" type="string" indexed="true" stored="true"/>
   <field name="HOSTID" type="string" indexed="true" stored="true"/>
   <field name="HOSTNAME" type="string" indexed="true" stored="true"/>
   <field name="HOSTTYPE" type="string" indexed="true" stored="true"/>
   <field name="H_TIME" type="string" indexed="true" stored="true"/>
   <field name="IENAME" type="string" indexed="true" stored="true"/>
   <field name="LOGONTYPE" type="string" indexed="true" stored="true"/>
   <field name="MEMBERNAME" type="string" indexed="true" stored="true"/>
   <field name="MI_TIME" type="string" indexed="true" stored="true"/>
   <field name="MON_TIME" type="string" indexed="true" stored="true"/>
   <field name="MSGFIELD" type="string" indexed="true" stored="true"/>
   <field name="OBJECTNAME" type="string" indexed="true" stored="true"/>
   <field name="OBJECTTYPE" type="string" indexed="true" stored="true"/>
   <field name="PROCESSNAME" type="string" indexed="true" stored="true"/>
   <field name="REMOTEHOST" type="string" indexed="true" stored="true"/>
   <field name="SEVERITY" type="string" indexed="true" stored="true"/>
   <field name="SOURCE" type="string" indexed="true" stored="true"/>
   <field name="TARGETDOMAIN" type="string" indexed="true" stored="true"/>
   <field name="TARGETUSER" type="string" indexed="true" stored="true"/>
   <field name="TIME" type="string" indexed="true" stored="true"/>
   <field name="TYPE" type="string" indexed="true" stored="true"/>
   <field name="TYPEFACILITY" type="string" indexed="true" stored="true"/>
   <field name="TYPESEVERITY" type="string" indexed="true" stored="true"/>
   <field name="TYPERESOURCE" type="string" indexed="true" stored="true"/>
   <field name="USERNAME" type="string" indexed="true" stored="true"/>
   <field name="WMTIME" type="string" indexed="true" stored="true"/>
  </fields>

 <!-- Field to use to determine and enforce document uniqueness.
      Unless this field is marked with required="false", it will be a required field
   -->
 <uniqueKey required="false" >WMTIME</uniqueKey>

 <!-- field for the QueryParser to use when an explicit fieldname is absent -->
 <defaultSearchField>MSGFIELD</defaultSearchField>

 <!-- SolrQueryParser configuration: defaultOperator="AND|OR" -->
 <solrQueryParser defaultOperator="OR"/>

  <!-- copyField commands copy one field to another at the time a document
        is added to the index.  It's used either to index the same field differently,
        or to add multiple fields to the same field for easier/faster searching.  -->


 <!-- Similarity is the scoring routine for each document vs. a query.
      A custom similarity may be specified here, but the default is fine
      for most applications.  -->
 <!-- <similarity class="org.apache.lucene.search.DefaultSimilarity"/> -->
 <!-- ... OR ...
      Specify a SimilarityFactory class name implementation
      allowing parameters to be used.
 -->
 <!--
 <similarity class="com.example.solr.CustomSimilarityFactory">
   <str name="paramkey">param value</str>
 </similarity>
 -->


</schema>