topic Re: splunk delimeter setup in Splunk Search

splunk delimeter setup

splunk_gs — Mon, 18 Jun 2012 14:07:48 GMT

i have a txt file that is seperated by semicolons ";" that i am sending via TCP. How do i set it up to where i can assign each seperation with a field? i tried doing it through the web manager but it wouldnt extract the fields.

This wouldn't work:
props.conf:
[xxx_fields]
DELIMS=";"
FIELDS = "x1", "x2", "x3", "x4", "x5", "x6", "x7", "x8", "x9"

Example would be:
Header
x1;x2;x3;x4;x5;x6;x7;x8;x9

Raw Fields
x;x;x;x;x;x;x;x;x

Basically i just want to be able to search by the header fields...please help

Re: splunk delimeter setup

Ayn — Mon, 18 Jun 2012 14:19:23 GMT

The DELIMS/FIELDS settings should go in transforms.conf, not props.conf. In props.conf you put a stanza that defines which data this should apply to, for instance by specifying a sourcetype, source or similar, and also a REPORT directive that refers to the transform containing the DELIMS/FIELDS settings.

EDIT: An example:

Let's say the logs you want to apply this to have sourcetype "my_sourcetype". In props.conf, you would put:

[my_sourcetype]
REPORT-getfields = mysourcetype_fields

In transforms.conf, put:

[mysourcetype_fields]
DELIMS=";"
FIELDS = "x1", "x2", "x3", "x4", "x5", "x6", "x7", "x8", "x9"

Fields should now be extracted for events with the sourcetype "my_sourcetype".

Re: splunk delimeter setup

splunk_gs — Mon, 18 Jun 2012 14:20:14 GMT

can you give me an example please?

Re: splunk delimeter setup

Ayn — Mon, 18 Jun 2012 14:27:58 GMT

Updated my answer with an example.