https://community.splunk.com/t5/Getting-Data-In/How-to-process-a-text-file/m-p/96399#M20098 <P>Have you tried using the Data input's data preview in the splunk web gui?</P> <P>Click manager/data/data inputs/Add data.</P> <P>It will allow you to play with the field extractions until its looking right.</P> Mon, 14 Oct 2013 04:11:01 GMT Lucas_K 2013-10-14T04:11:01Z https://community.splunk.com/t5/Getting-Data-In/How-to-process-a-text-file/m-p/96398#M20097 <P>Hi,</P> <P>I have a test file which I want to process in Splunk. I'm able to load it into Splunk, but I'm trying to get Splunk to understand the fields and I'm stuck in what to do next.</P> <P>For example:</P> <P>Timestamp Event<BR /> 1 10/14/13 10:43:35.000 AM<BR /><BR /> H20130326<BR /><BR /> 2 10/14/13 10:43:35.000 AM<BR /><BR /> D HE12201303250329551124038092GTB27C02020402201303250337540000700000000000000<BR /><BR /> 3 10/14/13 10:43:35.000 AM<BR /><BR /> D HE12201303250331431120034094GTB27C02020402201303250341580001000000000000000<BR /><BR /> 4 10/14/13 10:43:35.000 AM<BR /><BR /> D HE12201303250349001050366450GTB27C02020402201303250350440000100000000000000 </P> <P>As you can see, my data is pretty much a long line of characters. In excel, I would use delimiter by field length to extract the data for excel to understand the file. Can I do the same thing with Splunk?</P> <P>Much help is appreciated!</P> <P>Thanks in advanced.</P> Mon, 14 Oct 2013 03:13:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-process-a-text-file/m-p/96398#M20097 TimothyPeh 2013-10-14T03:13:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-process-a-text-file/m-p/96399#M20098 <P>Have you tried using the Data input's data preview in the splunk web gui?</P> <P>Click manager/data/data inputs/Add data.</P> <P>It will allow you to play with the field extractions until its looking right.</P> Mon, 14 Oct 2013 04:11:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-process-a-text-file/m-p/96399#M20098 Lucas_K 2013-10-14T04:11:01Z