topic Re: How do index TAB delimited files? in Splunk Search

How do index TAB delimited files?

Alan_Bradley — Mon, 05 Apr 2010 23:58:21 GMT

I am looking to read into SPLUNK a tab delimited file. But most of what I see is key based Field Extractions (, space, etc.)

Is there an example of how this might be done with TAB?

Re: How do index TAB delimited files?

gkanapathy — Tue, 06 Apr 2010 01:11:23 GMT

You should be able to make it work as with CSV files:

[mysourcetype]
DELIMS = "\t"
FIELDS = field1,f2,fieldthree

but specifying \t instead of , as the delimiter.

Re: How do index TAB delimited files?

camaney — Fri, 21 Oct 2011 00:56:35 GMT

where can i configutre this?

Re: How do index TAB delimited files?

nosignal — Mon, 29 Oct 2012 23:57:16 GMT

According to this, you configure this in transforms.conf BUT you also need a basic entry in props.conf that connects to the transform, e.g.:
include this in props.conf:

[My Source Type 1]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
REPORT-myname = mydelim

And include this in transforms.conf:

[mydelim]
DELIMS = "\t"
FIELDS = "TimeStamp","Colour","First Name","Shape"

Both files should reside in
$SPLUNK_HOME/etc/system/local/

e.g. C:\Program Files\Splunk\etc\system\local

I have described this exact process in more detail here - including the surprisingly difficult task of seeing the new field names once you have extracted them!

Re: How do index TAB delimited files?

rafamss — Thu, 08 Aug 2013 16:33:49 GMT

nosignal, i tested your sample and in my case perfect worked. Thank you!

Re: How do index TAB delimited files?

tirusplunk — Wed, 20 Nov 2013 04:25:49 GMT

Hi nosignal,

I included above things in props.conf and transforms.conf. But in preview of my log file I am getting the output like this.

Timestamp Event
1 11/19/13 6:46:50.000 PM "Time" "Temparature"

2 11/12/13 4:23:52.051 PM "11/12/2013 16:23:52.051" "+50"

3 11/12/13 4:23:53.051 PM "11/12/2013 16:23:53.051" "-40"

4 11/12/13 4:23:54.051 PM "11/12/2013 16:23:54.051" "-60"

5 11/12/13 4:23:55.051 PM "11/12/2013 16:23:55.051" "+50"

6 11/12/13 4:23:55.051 PM

I did follow by querying this like you said ..|stats dc(*) as *. But no use. Can you please help me in this regard?

Thanks,
Tiru

Re: How do index TAB delimited files?

tirusplunk — Wed, 20 Nov 2013 04:27:24 GMT

Hi rafamss,

I included above things in props.conf and transforms.conf. But in preview of my log file I am getting the output like this.

Timestamp Event 1 11/19/13 6:46:50.000 PM "Time" "Temparature"

2 11/12/13 4:23:52.051 PM "11/12/2013 16:23:52.051" "+50"

3 11/12/13 4:23:53.051 PM "11/12/2013 16:23:53.051" "-40"

4 11/12/13 4:23:54.051 PM "11/12/2013 16:23:54.051" "-60"

5 11/12/13 4:23:55.051 PM "11/12/2013 16:23:55.051" "+50"

6 11/12/13 4:23:55.051 PM

I did follow by querying this like you said ..|stats dc(*) as *. But no use. Can you please help me in this regard?

Thanks, Tiru

Re: How do index TAB delimited files?

rafamss — Fri, 22 Nov 2013 17:39:42 GMT

Hi Tiru,

Try this way: sourcetype[] | timechart count by temperature

Verify if works!

Thanks, Rafael

Re: How do index TAB delimited files?

landen99 — Tue, 28 Jul 2015 12:04:01 GMT

perhaps you mean

DELIMS=\t