topic Re: PROF Conf Issues in Splunk Search

PROF Conf Issues

SplunkDash — Thu, 12 Aug 2021 17:27:11 GMT

Hello, I was trying to write PROPS configuration file following sample events...

2021-06-08T13:26:53.665000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462|

2021-06-08T13:26:54.478000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462|

since it has pipe "|"..here is what I wrote..but not working... Any help will be highly appreciated...thank you so much..

SHOULD_LINEMERGE = false

LINE_BREAKER = ([\r\n]+)

INDEXED_EXTRACTIONS = psv

TIME_FORMAT = %Y%m%d %H:%M:%S:%Q

TIMESTAMP_FIELDS = TIMESTAMP

Re: PROF Conf Issues

anilchaithu — Thu, 12 Aug 2021 19:33:17 GMT

@SplunkDash

How are you onboarding this data?

If you are onboarding this data from a remote server using UF, you should place the props.conf on the remote server to extract the fields.

Its always better to test the extraction using UI i.e. settings -> Add Data -> upload -> choose psv as sourcetype. Once you are ok with extraction, copy the parameters deploy it over to the UF.

If this psv file does not has a header file, you need to mention the fields as well in the props.conf.

-- Hope this helps.