Getting Data In

How to process a text file

TimothyPeh
Engager

Hi,

I have a test file which I want to process in Splunk. I'm able to load it into Splunk, but I'm trying to get Splunk to understand the fields and I'm stuck in what to do next.

For example:

Timestamp Event
1 10/14/13 10:43:35.000 AM

H20130326

2 10/14/13 10:43:35.000 AM

D HE12201303250329551124038092GTB27C02020402201303250337540000700000000000000

3 10/14/13 10:43:35.000 AM

D HE12201303250331431120034094GTB27C02020402201303250341580001000000000000000

4 10/14/13 10:43:35.000 AM

D HE12201303250349001050366450GTB27C02020402201303250350440000100000000000000

As you can see, my data is pretty much a long line of characters. In excel, I would use delimiter by field length to extract the data for excel to understand the file. Can I do the same thing with Splunk?

Much help is appreciated!

Thanks in advanced.

0 Karma

Lucas_K
Motivator

Have you tried using the Data input's data preview in the splunk web gui?

Click manager/data/data inputs/Add data.

It will allow you to play with the field extractions until its looking right.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...