topic Re: How to extract the Fields from .txt file in Getting Data In

How to extract the Fields from .txt file

pbsuju — Thu, 23 Nov 2017 03:08:59 GMT

I am indexing Server.txt file from 1000+ forwarders. The file format is as below. I want to extract below header values as field while indexing it. Could someone please suggest what need to be added in props.conf of indexer to extract these fields. I am using splunk version of 6.4
ServerName,OSVersion,Make,Uptime,LastReboot (Fields to be extracted)

ServerName,OSVersion,Make,Uptime,LastReboot
Server1,Windows2008 R2,23hrs,10/10/2017
Server2,Windows2012 R2,13hrs,11/12/2107
Server3,Windows2012 R2,13hrs,11/11/2017

Re: How to extract the Fields from .txt file

mtulett_splunk — Thu, 23 Nov 2017 03:33:34 GMT

Since your data is already in CSV format, you can enable CSV extraction using the header row as the field names. Your props.conf should look like this:

[ csv_custom ]
DATETIME_CONFIG=NONE
INDEXED_EXTRACTIONS=csv
FIELD_DELIMITER=,

Note: You will need to distribute this config to the universal forwarders as well, since they need the configuration to correctly read the CSV file. Are you doing this, or are you only placing the config on the indexer?

This config appears to work correctly for me (I added the missing make field into the data):

Re: How to extract the Fields from .txt file

pbsuju — Tue, 29 Sep 2020 16:52:36 GMT

I already have below in props.conf of indexer . But I don't see fields getting extracted.

[server_Input]
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ,
FIELD_QUOTE = NONE
HEADER_FIELD_LINE_NUMBER = 1
DATETIME_CONFIG = NONE
CHECK_METHOD = modtime

Re: How to extract the Fields from .txt file

mtulett_splunk — Thu, 23 Nov 2017 04:33:04 GMT

I've updated my answer slightly.

Re: How to extract the Fields from .txt file

pbsuju — Mon, 27 Nov 2017 11:31:32 GMT

Thanks. It worked.