COnfiguration in props.conf not working

ChetanArgekar — Tue, 16 Feb 2021 13:26:09 GMT

None of my configurations in props.conf is working and entire file is coming as single event

HEADER_FIELD_LINE_NUMBER = 1 is also not working

Data is server patching data

CHG0030338_Linux_Executive_Summary.log

Change_Request_Number$$@@$$Planned_Start_Date$$@@$$Planned_End_Date$$@@$$CR_Type$$@@$$Type$$@@$$Application$$@@$$Total_Servers$$@@$$Servers_Successfully_Patching$$@@$$Servers_Failed_Patching$$@@$$Servers_Skipped_Patching
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Total$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Rhel$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$CentOS$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Suse$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0

inputs.conf

[monitor:///opt/splunkforwarder/patch/*Summary*.log]
disabled = 0
index = patch_dummy
sourcetype = patch_summary
crcSalt = <SOURCE>

props.conf

[patch_summary]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
HEADER_FIELD_LINE_NUMBER = 1
TRANSFORMS-sourcetype = patch_sourcetype
TRANSFORMS-route = patch-monitoring-route

transforms.conf

[patch-monitoring-route]
REGEX = .
DEST_KEY =_TCP_ROUTING
FORMAT = acn-dev1-route-group

[patch_sourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::patch

Re: COnfiguration in props.conf not working

scelikok — Wed, 17 Feb 2021 09:33:31 GMT

Hi @ChetanArgekar,

Please try below in props.conf

[patch_summary] DATETIME_CONFIG=CURRENT INDEXED_EXTRACTIONS=csv KV_MODE=none SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) HEADER_FIELD_LINE_NUMBER=1 FIELD_DELIMITER=$

Re: COnfiguration in props.conf not working

ChetanArgekar — Thu, 18 Feb 2021 15:02:38 GMT

It worked thanks for help

topic COnfiguration in props.conf not working in Getting Data In

COnfiguration in props.conf not working

Re: COnfiguration in props.conf not working

Re: COnfiguration in props.conf not working