topic Wrong indexed fields. in Getting Data In

Wrong indexed fields.

spisiakmi — Fri, 03 Apr 2020 11:52:52 GMT

Hi,

I want to index this csv file:

run_time;field1;field2;field3;field4;field5;field6;field7;field8;
80s;"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;

inputs.conf is

[monitor://\\srv\Log Sicherung\]
disabled = false
index = machinedata_w48
sourcetype = systest
crcSalt=<SOURCE>
ignoreOlderThan = 24h

and props.conf is

[systest]
BREAK_ONLY_BEFORE_DATE = 
CHARSET = WINDOWS-1252
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

In splunk will be indexed only
run_time;field1
and the field1 with the value:

"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;

Can you help me, please, how to solve this problem? I want to have indexed all fields* with proper values (separated with ;).

Re: Wrong indexed fields.

richgalloway — Fri, 03 Apr 2020 12:52:15 GMT

You've told Splunk the fields are separated by commas yet there are no commas in the data. That's why everything ends up in one field.

Try these props.conf settings:

[systest]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
FIELD_DELIMITER = ;
HEADER_FIELD_DELIMITER = ;

Re: Wrong indexed fields.

spisiakmi — Tue, 14 Apr 2020 14:23:56 GMT

Hi richgalloway. Thank you for your reaction. Unfortunately it didn't work. Nothing changed.