I have a text with values separated by spaces.This file does not have any headers. I need to add headers to this file and use this file in splunk. I can not manually do that as I will be getting a similar file every 15 minutes daily. Is there any way to do it using field extraction or something else in splunk?
The inputs.conf file needs to be on the forwarder that is monitoring the log directory. The props.conf and transforms.conf should be in the splunk\etc\system\local\ directory of the indexer. If those files don’t exist, then create them – make sure they have a .conf extension and not a .conf.txt extension.
You may need to further refine the configs, but if so you’ll need to provide more information.
[monitor://blankpathtofiledirectory] disabled = false index = default sourcetype = yourblanksourcetype
[yourblanksourcetype] SHOULD_LINEMERGE = false TIME_FORMAT = blank MAX_TIMESTAMP_LOOKAHEAD = blank REPORT-spaced = spacedfields
[spacedfields] DELIMS = “ “ FIELDS = list of comma separated fields
Space separated files are easy to index if the files all have the same field composition.
If you could put a header in every file, would it always be the same header? If so, post it.