Delimited field extractions for cognos data

[Pierceyuk]

Trying to load some IBM Cognos data, have the inputs.conf working and data is coming across.

but my props and transforms seem to have no effect. I followed the info here: http://answers.splunk.com/answers/1048/how-do-index-tab-delimited-files and from the documentation and created the following two files in my local folder.

Props.conf:
[cognos]
REPORT-cognos=cognos-fields

transforms.conf:
[cognos-fields]
DELIMS="\t"
FIELDS="Host ID","Process ID","Time","Time Zone","Session ID","Request ID","SubRequest ID","Step ID","Thread","Component ID","Build Number","Level","Logger","Operation","Object Type","Object Path","Status","Message","Log Data"

[Pierceyuk]

I was, but this is just the log data behind the dashboards used for troubleshooting when dashboards fail or users have issues.
Can you embed a html frame in a dashboard in splunk to show the cognos data? For us they are two very different systems so no need to merge. Easy option is just add a link to the cognos dashboard!

[karthikp1989]

Were you able to load Cognos reports data into Splunk? By IBM Cognos data, do you mean Cognos logs data or the actual BI reports that are run in Cognos?

I am looking for ways to get the Cognos reports data displayed on Splunk dashboard. Any hints at how to go about it will be greatly helpful!

Thank you.

[Pierceyuk · Accepted solution]

Was missing the local.meta file for this working at search time.

Adding that in and the search returned the expected fields.

[karthikp1989]

Were you able to load Cognos reports data into Splunk? By IBM Cognos data, do you mean Cognos logs data or the actual BI reports that are run in Cognos?
I am looking for ways to get the Cognos reports data displayed on Splunk dashboard. Any hints at how to go about it will be greatly helpful!
Thank you.