topic Creating fields based on a comma seperated list of values in Splunk Search

Creating fields based on a comma seperated list of values

sourabhguha — Sun, 27 Oct 2013 01:02:41 GMT

Hi,

I am indexing a set of csv files. the files do not have the header fields in it.

While I am creating the sourcetype, I would like to specify the following fields name for the sourcetype - which is a comma separated list. How can i do that?

tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG,

Re: Creating fields based on a comma seperated list of values

Ayn — Sun, 27 Oct 2013 08:00:22 GMT

Setup a delimiter based field extraction in props.conf / transforms.conf.

In props.conf, you put something like:

[yoursourcetype]
REPORT = getcsvfields

And in transforms.conf:

[getcsvfields]
DELIMS = ","
FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG