topic Re: field is not getting extracted in splunk web interface in Splunk Search

field is not getting extracted in splunk web interface

Tridi123 — Thu, 04 Oct 2012 12:41:34 GMT

**props.conf**
[text] 
NO_BINARY_CHECK = 1 
KV_MODE=none 
SHOULD_LINEMERGE=false
REPORT-comment=Extract_text

**transforms.conf**
[Extract_text] 
DELIMS= "|"
FIELDS= "empid","name","age"

but after restarting splunk i am not getting the fields empid,name and age getting extracted in splunk web interface on left panel
can any one help on this becuase my requirement is to make log data in table format using table query in
web interface

Re: field is not getting extracted in splunk web interface

sdaniels — Thu, 04 Oct 2012 12:44:32 GMT

Can you add your inputs.conf settings to your original question as well.

Re: field is not getting extracted in splunk web interface

alacercogitatus — Thu, 04 Oct 2012 12:52:05 GMT

Try putting a space between FIELDS so it looks like this:

FIELDS = "empid", "name", "age"

http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf

Re: field is not getting extracted in splunk web interface

Tridi123 — Thu, 04 Oct 2012 13:01:42 GMT

inputs.conf looks like
[default]
host = 01HW447731

Re: field is not getting extracted in splunk web interface

Tridi123 — Thu, 04 Oct 2012 13:02:28 GMT

location for inputs.conf is C:\Program Files\Splunk\etc\system\local

Re: field is not getting extracted in splunk web interface

Tridi123 — Thu, 04 Oct 2012 13:03:24 GMT

location C:\Program Files\Splunk\etc\system\local
inputs.conf looks like
[default]
host = 01HW447731

do i need to change it??

Re: field is not getting extracted in splunk web interface

Ayn — Thu, 04 Oct 2012 13:03:34 GMT

inputs.conf on the host you got this data from, please.

Re: field is not getting extracted in splunk web interface

sdaniels — Thu, 04 Oct 2012 13:08:25 GMT

I believe that your inputs.conf needs to reference a sourcetype. The sourcetype is the classification of your data.

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter

In props.conf you have a stanza with [text] therefore the sourcetype set for your input should have:

[default] 
host = 01HW447731
sourcetype=text

http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf

[]
* This stanza enables properties for a given .
* A props.conf file can contain multiple stanzas for any number of different .
* Follow this stanza name with any number of the following attribute/value pairs, as appropriate
for what you want to do.
* If you do not set an attribute for a given , the default is used.

can be:
1. , the source type of an event.
2. host::, where is the host for an event.
3. source::, where is the source for an event.
4. rule::, where is a unique name of a source type classification rule.
5. delayedrule::, where is a unique name of a delayed source type
classification rule.
These are only considered as a last resort before generating a new source type based on the
source seen.