topic Re: help on sourcetype parsing in Getting Data In

help on sourcetype parsing

jip31 — Wed, 21 Aug 2019 07:30:52 GMT

hello

I want to create a new sourcetype from the csv file below
https://www.cjoint.com/c/IHvhvr2JHYh
I dont want to collect the logs between line 1 and line 561 and I just need to collect the logs from line 562
More, I need to create a new field called "flagname" for being able to extract piece of logs like TEST-TOUPDATE.$w$ (in red color in the csv file, line 562)
so what I have exactly to do in advanced parameters to do this??
thanks in advance

Re: help on sourcetype parsing

adonio — Wed, 21 Aug 2019 13:53:48 GMT

check out these answers:
for header line if necessary:
https://answers.splunk.com/answers/699899/in-a-csv-file-can-you-help-me-skip-the-first-few-l.html

for ignoring lines:
https://answers.splunk.com/answers/11512/how-to-not-index-first-x-lines-in-csv-file.html

Re: help on sourcetype parsing

jip31 — Mon, 26 Aug 2019 09:02:58 GMT

It doesnt help me a lot but i am going to find a good way