Getting Data In

How to parse out asterisk delimited format?

skirven
Communicator

Hi! I'm having a struggle trying to get Splunk to recognize a file that's in Asterisk Delimited Format. I have the props.conf set like this below, running on a Splunk 7.3.8 HF, sending the cooked data to a 8.1.72 Search Peer. Nothing I've tried will get the data to parse correctly. Everything I'm reading, this should work. I've opened a support case, but I'm going around in circles with them, so if anyone has any thought here, I would appreciate it!

 

 

 

[ sourcetype ]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=UTF-8
disabled=false
FIELD_DELIMITER=*
FIELD_NAMES=timestamp,.....
TRUNCATE=50000

 

 

 

Thanks,
Stephen 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @skirven,

as you can read at https://docs.splunk.com/Documentation/Splunk/8.2.6/admin/Propsconf to use the FIELD_DELIMITER, you have to set the INDEXED_EXTRACTIONS parameter, which kind of file are you using? a CSV?

Ciao.

Giuseppe

0 Karma

skirven
Communicator

Thanks. I did see that, and had tried that. The file is a log file, but in Asterisk Delimited Format. I'll test with INDEXED_EXTRACTIONS=CSV and the FIELD_DELIMITER=* and see what happens.

Thanks.
Stephen

0 Karma

skirven
Communicator

That didn't work either. 😞

[ sourcetype ]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=UTF-8
disabled=false
FIELD_DELIMITER=*
FIELD_NAMES=timestamp,.....
TRUNCATE=50000
INDEXED_EXTRACTIONS=CSV
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...