Getting Data In

How to process a text file



I have a test file which I want to process in Splunk. I'm able to load it into Splunk, but I'm trying to get Splunk to understand the fields and I'm stuck in what to do next.

For example:

Timestamp Event
1 10/14/13 10:43:35.000 AM


2 10/14/13 10:43:35.000 AM

D HE12201303250329551124038092GTB27C02020402201303250337540000700000000000000

3 10/14/13 10:43:35.000 AM

D HE12201303250331431120034094GTB27C02020402201303250341580001000000000000000

4 10/14/13 10:43:35.000 AM

D HE12201303250349001050366450GTB27C02020402201303250350440000100000000000000

As you can see, my data is pretty much a long line of characters. In excel, I would use delimiter by field length to extract the data for excel to understand the file. Can I do the same thing with Splunk?

Much help is appreciated!

Thanks in advanced.

0 Karma


Have you tried using the Data input's data preview in the splunk web gui?

Click manager/data/data inputs/Add data.

It will allow you to play with the field extractions until its looking right.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!