https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97401#M20306 <P>You are right about the output looking nicely formed. I had more than 1 tab space between columns. Once I reduced it to just 1 tab, the multikv worked without forceheader=1. Thanks for the help</P> Wed, 21 Mar 2012 06:56:24 GMT mridus 2012-03-21T06:56:24Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97398#M20303 <P>Hi,<BR /> I have written a script whose output is:<BR /><BR /> It is well formatted (arranged in columns although the formatting is not visible here in this post)</P> <PRE><CODE>Type PerSecond PerTransaction PerExec PerCall DB Time(s): 0.7 30.1 0.49 2.75 DB CPU(s): 0.1 3.5 0.06 0.32 Redo size: 1,365.6 55,655.8 0.00 0.00 Logical reads: 2,483.3 101,208.4 0.00 0.00 Block changes: 3.3 132.7 0.00 0.00 Physical reads: 2,436.6 99,305.7 0.00 0.00 Physical writes: 0.6 24.9 0.00 0.00 User calls: 0.3 11.0 0.00 0.00 Parses: 1.2 48.7 0.00 0.00 Hard parses: 0.0 0.6 0.00 0.00 W/A MB processed: 0.0 1.8 0.00 0.00 Logons: 0.0 1.1 0.00 0.00 Executes: 1.5 61.9 0.00 0.00 Rollbacks: 0.0 0.4 0.00 0.00 Transactions: 0.0 0.00 0.00 0.00 </CODE></PRE> <P>My props.conf looks like: </P> <PRE><CODE>[Load_Profile] BREAK_ONLY_BEFORE=Type MAX_EVENTS=16 NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true </CODE></PRE> <P>After the data is Splunked, when I multikv, it does not seem to work. What could be the problem here?</P> <P>I have also tried having the scripted output without the headers:</P> <PRE><CODE>DB Time(s): 0.7 30.1 0.49 2.75 DB CPU(s): 0.1 3.5 0.06 0.32 Redo size: 1,365.6 55,655.8 0.00 0.00 Logical reads: 2,483.3 101,208.4 0.00 0.00 Block changes: 3.3 132.7 0.00 0.00 Physical reads: 2,436.6 99,305.7 0.00 0.00 Physical writes: 0.6 24.9 0.00 0.00 User calls: 0.3 11.0 0.00 0.00 Parses: 1.2 48.7 0.00 0.00 Hard parses: 0.0 0.6 0.00 0.00 W/A MB processed: 0.0 1.8 0.00 0.00 Logons: 0.0 1.1 0.00 0.00 Executes: 1.5 61.9 0.00 0.00 Rollbacks: 0.0 0.4 0.00 0.00 Transactions: 0.0 0.00 0.00 0.00 </CODE></PRE> <P>props.conf: </P> <PRE><CODE>[Load_Profile] SHOULD_LINEMERGE = false LINE_BREAKER = ^()$ TRUNCATE = 1000000 DATETIME_CONFIG = CURRENT REPORT-fields_for_load_profiles_sh = fields_for_load_profiles_sh </CODE></PRE> <P>transforms.conf: </P> <PRE><CODE>[fields_for_load_profiles_sh] REGEX = ([A-Za-z\s\(\)\/]+)\:*\s+(\d*\,*\d*\.*\d*)\s+(\d*\,*\d*\.*\d*)\s+(\d*\,*\d*\.*\d*)\s+(\d*\,*\d*\.*\d*) FORMAT = Type::$1 PerSecond::$2 PerTransaction::$3 PerExec::$4 PerCall::$5 </CODE></PRE> <P>This does not seem to work either. Can somebody help?</P> Tue, 20 Mar 2012 18:33:47 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97398#M20303 mridus 2012-03-20T18:33:47Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97399#M20304 <P>I would use the following props.conf stanza:</P> <PRE><CODE>[Load_Profile] BREAK_ONLY_BEFORE=Type SHOULD_LINEMERGE=true DATETIME_CONFIG = CURRENT </CODE></PRE> <P>Keep the header line, and multikv will use it to create the fields. You should not need the transforms.conf at all. <BR /> You might try <CODE>multikv forceheader=1</CODE> to see if that picks up the header.</P> <P>Another idea - I see that the output is very nicely formatted in columns - but is it formatted consistently for each line? I think Splunk might do better if there was always a single tab between columns, even though that would not look nice as a printed output. If some rows in the table have differing numbers of spaces and/or tabls, I don't know if Splunk will be able to properly extract the fields.</P> Wed, 21 Mar 2012 05:40:09 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97399#M20304 lguinn2 2012-03-21T05:40:09Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97400#M20305 <P>Hi,<BR /> Thanks. I have already done multikv forceheader=1 but I see that the values of the keys are followed by spaces. So currently I am doing "convert rmunit" to convert the numbers to be used with "stat avg".<BR /> Any idea why the spaces are included in the values? Can they be avoided? I don't want to be changing all the strings to numbers for every arithmetic function I use.</P> Wed, 21 Mar 2012 06:32:02 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97400#M20305 mridus 2012-03-21T06:32:02Z https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97401#M20306 <P>You are right about the output looking nicely formed. I had more than 1 tab space between columns. Once I reduced it to just 1 tab, the multikv worked without forceheader=1. Thanks for the help</P> Wed, 21 Mar 2012 06:56:24 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-with-Props-and-Transforms/m-p/97401#M20306 mridus 2012-03-21T06:56:24Z