topic Re: How do I input data event and fields? in Getting Data In

How do I input data event and fields?

ichesla1111 — Thu, 15 Dec 2022 20:31:36 GMT

Hello,

I am inputting a file into Splunk showing the computers system information extracted from the command prompt. The data file I am inputting input Splunk looks like the first photo below, where I want the fields to be set as the values in the first column (circled in red) and their field values equal to their corresponding output value.

YETTT, when adding it to Splunk, it breaks down the system information file into three events (instead of 1), see image below.

How do I merge these three events into one (match the text file uploaded) and set the fields equal to the systems characteristics seen in the first column (circled in blue)?

Re: How do I input data event and fields?

richgalloway — Fri, 16 Dec 2022 01:16:03 GMT

Welcome to the fun world of GDI (Getting Data In)!

If you're getting three events when you should be getting one then your line breaking needs to be adjusted. Try

LINE_BREAKER = ([\r\n])Host Name:

Extracting fields from the input is fairly simple with a series of EXTRACT statements. Don't try to do the whole thing in one go because that will drive you mad and will break too easily. (Clever people with a transform that will do the extractions are welcome to chime in!)

EXTRACT-hostname = Host Name:\s+(?<HostName>\S+) EXTRACT-osname = OS Name:\s+(?<OSName>.*$) <<and so on>>

And to fix that warning about timestamp extraction, put this in props.conf

DATETIME_CONFIG = CURRENT