Getting Data In

Index list type data using props.conf

bnakkella
New Member

Hi,

I have a sever with splunk enterprise installed to monitor a directory containing <sample-filename>.gz files

Each file is of the below format and need to create a sourcetype that can 

1. Ignore lines staring with //

2. Map the vales in [ ] to a standard header

----------------------------------------------------

[1599249608,75972,"sample@user.ca",638744076,1,861,337,3,"9","http",80,388951746,"http://abc.com",0,"","","","empty","Sample Filtering","","ctldl.windowsupdate.com","GET",21,3,126]

// random info here

// something something random

-------------------------------------------------------

Tried various strategies but filed. Looking for you help.

 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

provide field header.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...