Getting Data In

File won't index

timmy13
Communicator

In testing for implementation on an enterprise Splunk implementation, I am working on my XP desktop with Splunk 4.31 installed.

I have a file that is essentially a csv file but is delimited by pipes (|). I want to use props.conf and transforms.conf to extract the fields. I have everything set up, I THINK correctly, but the file simple will not index. I am getting no data. Any help appreciated!

Here's the configs

inputs.conf....

[default]
host = MyPC

[monitor://C:\Documents and Settings\c5012044\My Documents\ebqa4\ebqa4a.pipe]
disabled = 0
followTail = 0
sourcetype = ebqa

props.conf...

[ebqa]
SHOULD_LINEMERGE = false
TRANSFORMS-t01 = csv1-fieldextraction
NO_BINARY_CHECK = 1
pulldown_type = 1

and transforms.conf...

[csv1-fieldextraction]
DELIMS="|"
FIELDS="TimeStamp","Start_Timestamp","Commit_Timestamp","Operation","Username","OS_Username", "Machine_Name", "SQL_Redo"

Thanks in advance for your help.

0 Karma

MarioM
Motivator
0 Karma

timmy13
Communicator

As I mentioned initially, this is on a test system. I have indexed exactly two files (or attempted to). This, and one other. Even on the Search App summary page, I seee only the other source, not this source. I am boggled.

0 Karma

MarioM
Motivator

this is strange...the only reason i could see is that the data is sent to an index which is NOT searched by default...
But as per your inputs.conf there is no specific index specified...
does 'index="*" sourcetype=ebqa' bring nothing too?

0 Karma

timmy13
Communicator

10 Records, no errors. I see the same info in the splunkd.log file. Mainly INFO events about parsing the file. 2 Warnings about timestamps being far apart, but accepted anyway.

0 Karma

MarioM
Motivator

what do you get from this search:

index=_internal sourcetype=splunkd "*.pipe"

Any errors?

0 Karma

timmy13
Communicator

Yes, I do
Says "Finished reading"

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.