Now a days when I extract fields, need 1000ea fields.
so, i defined in transforms.conf and props.conf about 1000 ea fields.
But Splunk can not recognizes.
[sourcetype] REPORT-sourcetype = delimExtractions_CC_type
[delimExtractions_CC_type] DELIMS = "|" FIELDS = "time", "A0001","A0002","A0003","A0004",.... "A1713","A1714","A1715"
I need add something in transforms.conf and props.conf?
You could try adding the following to
[kv] maxcols = 1750
By default, Splunk does not extract more than 512 fields, for performance reasons.
You might also check to make sure that your events are not being truncated, although it looks like they are okay.
I assume that in props.conf, it does not literally say 'sourcetype', but rather the actual sourcetype of your data.
Also, are your events really that long? 1500+ pipe-separated fields? Always the same length?
Please post a sample event.