Getting Data In

Indexed time extraction for Pipe Delimited

renzgujian
Loves-to-Learn Lots

Hi guys, I have a monitored CSV file that is Pipe delimited


I was trying to extract the fields so that header1 will be a field header, and that value1 and valueA will be the values extracted under it.
However currently I'm getting  3 events where each line is a single event

I have 2 query,
1) do i have to do a props + transform? or will just a props suffice?
2) Where do I place this props.conf? I see that for Indexed_Extraction i have to put it as UF level?

Sample Logs
header1|header2|header3|header4|header5
value1|value2|value3|value4|value5
valueA||valueC||valueE

 

Current Props (not working)

[sourcetypeA]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Labels (4)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @renzgujian 

Place the props.conf on UF (forwarder) and restart. 

---

An upvote would be appreciated if it helps!

0 Karma

renzgujian
Loves-to-Learn Lots

@venkatasri i have tried that, it did not work. 
the data did not get ingested when i place the props inside the fwder

inputs @fwder
[monitor:///opt/logs/input.csv]
index=test
sourcetype = test_log
disabled = 0

props @fwder 

[test_log]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

 

 

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...