Getting Data In
Highlighted

I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

New Member

Sample Data:
FILED1|FIELD2|FIELD3|FIELD4
INDIA|AGRICULTURE|HELLO|200
AMERICA|FOOD|HELLO |404
CHINA|PEOPLE|HI|402
NEPAL|COLTHS|HI|411

Output should have only have only field FIELD2 & FIELD3 data.

Inputs.conf
[monitor://C:\testauths*.txt]
index=main
sourcetype=mytestdata

props.conf
[mytestdata]
CHARSET=AUTO
DATETIMECONFIG=CURRENT
INDEXED
EXTRACTIONS=csv
SHOULDLINEMERGE=false
disabled=false
pulldown
type=true
FIELDDELIMITER=|
HEADER
FIELDLINENUMBER=0
REPORT-fields = getLogData

transforms.conf
[getLogData]
DELIMS = "|"
FIELDS= "",FIELD2,FIELD3,""

I am sure somewhere i am making mistake.

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

SplunkTrust
SplunkTrust

Do you want them indexed, or extracted at search time?

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

New Member

I want to them to be indexed.

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

SplunkTrust
SplunkTrust

Here's some things that I'd try, one at a time -

A) change to INDEXED_EXTRACTIONS=psv.
(This may not help but should not hurt.)

B) change namespace from REPORT-fields to REPORT-search or REPORT-yourappname.
(This is my best guess of the real issue.)

C) remove pulldown_type clause
(In the admin manual, it says # NOT YOURS. DO NOT SET.)

D) remove disabled clause
(I don't find it in the admin manual for that stanza.)

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

New Member

Tried with the above changes but now I am not getting any data indexed.

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

SplunkTrust
SplunkTrust

which change caused the data to stop indexing?

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

New Member

After restarting splunk all data are getting indexed rather than the two fields.

0 Karma
Highlighted

Re: I want to parse the below structured data. I want only second and third field to get indexed and rest to be discarded. I am using the below configuration:

Explorer

Hi @umeshagarwal008

You can use field transformations in props, TRANSFORMS-q=nq
then in transforms.conf
[nq]
REGEX=CHINA.* | NEPAL.*
FORMAT=queue
DEST_KEY=nullQueue

hope this helps..

Regards,
Pramodh

0 Karma