https://community.splunk.com/t5/Getting-Data-In/monitor-csv-data/m-p/55956#M10938 <P>I am performing the following test in my env,</P> <P><CODE>props.conf<BR /> [newcsvtest]<BR /> REPORT-newcsvtest = newcsvtest<BR /> SHOULD_LINEMERGE = false<BR /> TIME_FORMAT = %H:%M:%S<BR /> TIME_PREFIX = ^<BR /> SHOULD_LINEMERGE = false<BR /> LINE_BREAKER = ([\r\n]+)<BR /> </CODE><BR /> with a corresponding <BR /> <CODE><BR /> transforms.conf<BR /> [newcsvtest]<BR /> DELIMS = ","<BR /> FIELDS = field1, field2, field3, field4, field5, field6, field7, field8, field9, field10, field11<BR /> </CODE><BR /> and used the following for monitoring the data:</P> <P><CODE>/opt/splunk/bin/splunk add monitor /opt/splunk/etc/apps/sample_app/logs/logtestdata/newcsvtest_log -sourcetype newcsvtest -index _internal</CODE></P> <P>however, the csv file of the following format doesn't get line seperated appropriately </P> <P><CODE>13:05:00,1781,3,3,1785,2,0,0,0,2,20<BR /> 13:10:00,1781,3,3,1785,2,0,0,0,2,20<BR /> 13:15:00,1781,3,3,1785,2,0,0,0,2,20<BR /> </CODE><BR /> Any help would be greatly appreciated.<BR /> Thanks.</P> Sun, 22 Jan 2012 20:15:56 GMT schava2 2012-01-22T20:15:56Z https://community.splunk.com/t5/Getting-Data-In/monitor-csv-data/m-p/55956#M10938 <P>I am performing the following test in my env,</P> <P><CODE>props.conf<BR /> [newcsvtest]<BR /> REPORT-newcsvtest = newcsvtest<BR /> SHOULD_LINEMERGE = false<BR /> TIME_FORMAT = %H:%M:%S<BR /> TIME_PREFIX = ^<BR /> SHOULD_LINEMERGE = false<BR /> LINE_BREAKER = ([\r\n]+)<BR /> </CODE><BR /> with a corresponding <BR /> <CODE><BR /> transforms.conf<BR /> [newcsvtest]<BR /> DELIMS = ","<BR /> FIELDS = field1, field2, field3, field4, field5, field6, field7, field8, field9, field10, field11<BR /> </CODE><BR /> and used the following for monitoring the data:</P> <P><CODE>/opt/splunk/bin/splunk add monitor /opt/splunk/etc/apps/sample_app/logs/logtestdata/newcsvtest_log -sourcetype newcsvtest -index _internal</CODE></P> <P>however, the csv file of the following format doesn't get line seperated appropriately </P> <P><CODE>13:05:00,1781,3,3,1785,2,0,0,0,2,20<BR /> 13:10:00,1781,3,3,1785,2,0,0,0,2,20<BR /> 13:15:00,1781,3,3,1785,2,0,0,0,2,20<BR /> </CODE><BR /> Any help would be greatly appreciated.<BR /> Thanks.</P> Sun, 22 Jan 2012 20:15:56 GMT https://community.splunk.com/t5/Getting-Data-In/monitor-csv-data/m-p/55956#M10938 schava2 2012-01-22T20:15:56Z https://community.splunk.com/t5/Getting-Data-In/monitor-csv-data/m-p/55957#M10939 <P>this worked in a different env for me. Thanks.</P> Mon, 23 Jan 2012 00:37:03 GMT https://community.splunk.com/t5/Getting-Data-In/monitor-csv-data/m-p/55957#M10939 schava2 2012-01-23T00:37:03Z