All Apps and Add-ons

How to get fields from tab limited log files with single header?

tirusplunk
Engager

How to get fields from tab limited log files with single header?

I could not find the following files inputs.conf and prop.conf in directory $SPLUNK_HOME/etc/system/local to set the fields. Is there another way to do it?

Thanks,
Tirumal

Tags (2)
0 Karma

lukejadamec
Super Champion

After you create your inputs.conf and props.conf you will need to create some configuration items to make this work. You did not provide a lot of details, so you'll have to fill in the blanks:

inputs.conf

[monitor://blank]  
disabled = false  
sourcetype = yourblanksourcetype

props.conf

[yourblanksourcetype]
MAX_TIMESTAMP_LOOKAHEAD = blank
SHOULD_LINEMERGE = blank
CHECK_FOR_HEADER = true
HEADER_FIELD_DELIMITER = \t
TZ = blank

martin_mueller
SplunkTrust
SplunkTrust

If you don't have a .conf file in */local yet you can create an empty file and start from there.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!