topic Re: Need to ingest structured data in Getting Data In

Need to ingest structured data

csharm21 — Fri, 26 Apr 2019 12:17:45 GMT

Hi Team,

I need to ingest the structure data but the file is not in csv format. however data inside it is structured. below is the log format which i want to index. can anyone help me with the instruction how we can do this.

#Fields: event,computer,operator,source,sourceid,executionid,starttime,endtime,datacode,databytes,message
PackageStart,pppep2413,MS\test,Spettl_tset,{43474344gfg94341B9-4186-gfC4-102E3fgfg0},{cgfgfg-bgfdf-4FFA-gggg-0C57996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,Beginning of package execution.
OnPreExecute,pppep2413,MS\test,Spettl_tset,{43474344E55-94341B9-4186-B5C4-C1fgfgfgfg0},{fgdfgdf-ggfgfD-gdf-A679-0C546CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
OnPreExecute,pppep2413,MS\test,Get Trigger ID,{4A50954F-137E-4CDD-A20F-fgfg},{fsdfgfgfsdf5-CedD-4FFA-A679-0436CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
g

Re: Need to ingest structured data

somesoni2 — Fri, 26 Apr 2019 14:30:50 GMT

See this. (even though file extension is not CSV, data is, so you'd need to create a custom sourcetype with field extraction configuration mentioned in below link)
https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/Data/Extractfieldsfromfileswithstructureddata

You may have to remove #Fields: from the data, so look for [ExtractCorrectHeaders] in above link.

Re: Need to ingest structured data

csharm21 — Fri, 26 Apr 2019 14:50:53 GMT

Thanks @somesoni2 I was following this document but still confused how to start. would it be possible for you to share one example for me to create props and input with above data to remove #Fields:

Re: Need to ingest structured data

somesoni2 — Fri, 26 Apr 2019 15:35:00 GMT

Give this a try (on your forwarder)

[YourSourcetypeHere]
FIELD_HEADER_REGEX=\#Fields\:\s(.*)
FIELD_DELIMITER=,
TIMESTAMP_FIELDS = starttime