topic Re: Yet another question related to tab delimited input files. in Getting Data In

Yet another question related to tab delimited input files.

feltsb — Wed, 02 Apr 2014 19:33:03 GMT

I would like to import a tab delimited text file, where the first line of the file contains field names instead of field values.

Re: Yet another question related to tab delimited input files.

somesoni2 — Wed, 02 Apr 2014 20:16:49 GMT

what splunk version?

Re: Yet another question related to tab delimited input files.

feltsb — Wed, 02 Apr 2014 20:37:54 GMT

6.0.2, Mac OS X (splunk-6.0.2-196940-darwin-64 running on 10.9.2)

Re: Yet another question related to tab delimited input files.

kristian_kolb — Thu, 03 Apr 2014 09:20:22 GMT

Have you looked at the props.conf settings for CSV/TSV files? These include, but are not limited to;

[your_sourcetype]
SHOULD_LINEMERGE = false
INDEXED_EXTRACTIONS = TSV
HEADER_FIELD_LINE_NUMBER = 1
FIELD_QUOTE = "
TIMESTAMP_FIELDS = your_timestamp_field(s)

Read more in the props.conf spec file.
http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf

Hope this helps,