All Apps and Add-ons
Highlighted

not able to extract fileds

Contributor

Dear All,

Here is my one event

S.R. Cable TV Pvt Ltd ,Indore,Indore,Indore,Indore,01/04/2010,30/04/2010,Broadband,262,217,232, 11384,8266,8699,280,341,Direct Subs,20,172

i am able to extract all the fields accept bold letter fields in data.

i want to extract indore which is 5th field in line. but when i want to extract it is taking 2nd field as extracted field.

lly it is happening for all fields which bold in event.

Please can anyone help me on this.

Thanks
Gajanan

0 Karma
Highlighted

Re: not able to extract fileds

Ultra Champion

How do you try to extract them?
What does your config files (props/transforms) look like?

Is that a CSV formatted file? In that case, you might have a look at DELIMS;

props.conf

[your_sourcetype]
REPORT-blah = extract_stuff

transforms.con

[extract_stuff]
DELIMS = ","
FIELDS = field1, field2, field3 ...

Hope this helps,

K

View solution in original post

0 Karma
Highlighted

Re: not able to extract fileds

Contributor

Hey Kristian,
Try to extract field using field extractor

my props.conf looks like

Version 5.0.3

[splunkd]
EXTRACT-fields = (?i)^(?:[^ ]* ){2}(?:[+-]\d+ )?(?P[^ ]*)\s+(?P[^ ]+) - (?P.+)

[splunkwebservice]
EXTRACT-useragent = userAgent=(?P[^ (]+)

yes that file is in csv format

let me try your solution

Thanks
gajanan

0 Karma
Highlighted

Re: not able to extract fileds

Contributor

Thank you so much kristian,it works for me.

0 Karma