topic Re: CSV field extraction on a deployed app in Getting Data In

CSV field extraction on a deployed app

virtualpony — Mon, 28 Sep 2020 11:49:06 GMT

I have a app that is deployed on a host that polls a csv file. I can get data in to the Splunk indexer, but it does not recognize the fields as described in the transforms.conf file located in the apps default directory. Here is what I have.

C:\Program
Files\SplunkUniversalForwarder\etc\apps\vievents\default

inputs.conf[monitor://E:\Logs\vcenter\vievents.csv] disabled = false sourcetype = vievents_csv

props.conf[vievents_csv] SHOULD_LINEMERGE = false TRANSFORMS-vievents = vievents_extractions

transforms.conf[vievents_extractions] DELIMS="," FIELDS="CreatedTime","Key","ChainId","EventType","UserName","Datacenter","ComputeResource","Host","Vm","Ds","Net","Dvs","FullFormattedMessage"

How do I get splunk to recognize the fields? Thanks.

Re: CSV field extraction on a deployed app

dbryan — Tue, 15 May 2012 01:48:06 GMT

Could you post an example row from the raw data?

Re: CSV field extraction on a deployed app

virtualpony — Tue, 15 May 2012 01:51:54 GMT

Here you go. I just modified some text for privacy, but otherwise structure is the same. Some of the characters like colons and slashes get stripped.
"4/27/2012 1:37:45 PM","71642","71638","VmMacAssignedEvent","IIGCF\lus3","USLAB1","Management","uslab1esxi05.domain.com","FreeBSD",,,,"New MAC address (00:50:56:99:77:90) assigned to adapter c3 88 19 50 5c f5 fa 1a-51 58 6c b7 84 16 7a 90 for FreeBSD"

Re: CSV field extraction on a deployed app

Ayn — Tue, 15 May 2012 05:16:42 GMT

So, do you have these props.conf / transforms.conf settings on the indexer? Or just the host that the data is read from?

Re: CSV field extraction on a deployed app

virtualpony — Tue, 15 May 2012 05:20:25 GMT

well I initially included them in the app directory on the forwarded host, but I also copied them to the indexers system local directory. Rebooted, but no difference.

Re: CSV field extraction on a deployed app

virtualpony — Tue, 15 May 2012 22:46:49 GMT

Issue solved. Replaced TRANSFORMS-vievents with REPORT-vievents. Reboot splunkd.

Also needed to rename some field names as they overlap with existing splunk fields: EventType, Host