topic Re: Splunk dont show fields after parsed. why? in Splunk Search

Splunk dont show fields after parsed. why?

shayhk — Tue, 26 Nov 2013 13:21:13 GMT

Sample Log File

2013-10-31|2013-10-31 00:00:00|serv1|ws1|Mozilla|p1=1,p2=2,p3=3|hash1||method1|id||2.01

2013-11-01|2013-10-31 00:00:00|serv1|ws2|Chrome|p1=55,p2=432,p3=3|hash2||method2|id||3.31

2013-10-03|2013-10-31 00:00:00|serv1|ws3|Explorer|p1=34,p2=434434,p3=555555|hash3||method3|id||4.41

Question

The log fields are fixed and there is adlimiter '|' between them

I want that the splunk automaticlly parse data rows into fileds
I add the prop.conf these attributes

DELIMS = "|"

Why dont I see those fields on the Selected/Interesting Fields list?
what am i missing?

Re: Splunk dont show fields after parsed. why?

_d_ — Tue, 26 Nov 2013 13:37:22 GMT

Those attributes belong in a transforms.conf instead.

props.conf [my_sourcetype] REPORT-my_fields = my_fields

transforms.conf [my_fields] DELIMS = "|" FIELDS = "date","datetime","service","ws","browser","params","gui","empty","method","id","status","ver"

EDIT: You need commas between field names.

Re: Splunk dont show fields after parsed. why?

lukejadamec — Tue, 26 Nov 2013 13:42:21 GMT

The DELIMS and FIELDS belong in transforms.conf not props.conf. Also, in FIELDS remove the quotes and delimiters - use a space separated list of fields.

FIELDS = date datetime service ws browser params gui empty method id status ver

You will need an entry in props.conf to point the source or sourcetype to the transform stanza like this:

props.conf

[yoursourcetype]
REPORT-yourfieldlist = fieldlist

transforms.conf

[fieldlist]
DELIMS = "|"

FIELDS = date datetime service ws browser params gui empty method id status ver

Re: Splunk dont show fields after parsed. why?

shayhk — Tue, 26 Nov 2013 14:15:36 GMT

i dont have a transforms.conf file.
only props.conf.
how can i do it from the SplunkWeb Gui?
thanks

Re: Splunk dont show fields after parsed. why?

lukejadamec — Tue, 26 Nov 2013 14:26:28 GMT

You can't.
You need to create the file on the indexer at:
splunk\etc\system\local\transforms.conf

Re: Splunk dont show fields after parsed. why?

shayhk — Tue, 26 Nov 2013 15:15:18 GMT

all i need to do is to create the file and define it like you did?

Re: Splunk dont show fields after parsed. why?

_d_ — Tue, 26 Nov 2013 15:17:42 GMT

Yes, as long as the REPORT-xxx in props.conf references the stanza name in transforms.conf.

Re: Splunk dont show fields after parsed. why?

lukejadamec — Tue, 26 Nov 2013 16:33:56 GMT

Don't forget to restart splunkd when you're done with the file.

Re: Splunk dont show fields after parsed. why?

shayhk — Wed, 27 Nov 2013 11:32:19 GMT

I did all these thing and still, the fileds i asked for are are not showen in the selected\Interesting fields bar.

Re: Splunk dont show fields after parsed. why?

shayhk — Wed, 27 Nov 2013 11:34:51 GMT

it's not working.
i changed the props.conf + transforms.conf
and restarted the splunk service.

Re: Splunk dont show fields after parsed. why?

shayhk — Wed, 27 Nov 2013 11:37:18 GMT

FIELDS = date datetime service ws browser params gui empty method id status ver
or

????