Getting Data In

Indexed time extraction for Pipe Delimited

renzgujian
Loves-to-Learn Lots

Hi guys, I have a monitored CSV file that is Pipe delimited


I was trying to extract the fields so that header1 will be a field header, and that value1 and valueA will be the values extracted under it.
However currently I'm getting  3 events where each line is a single event

I have 2 query,
1) do i have to do a props + transform? or will just a props suffice?
2) Where do I place this props.conf? I see that for Indexed_Extraction i have to put it as UF level?

Sample Logs
header1|header2|header3|header4|header5
value1|value2|value3|value4|value5
valueA||valueC||valueE

 

Current Props (not working)

[sourcetypeA]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Labels (4)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @renzgujian 

Place the props.conf on UF (forwarder) and restart. 

---

An upvote would be appreciated if it helps!

0 Karma

renzgujian
Loves-to-Learn Lots

@venkatasri i have tried that, it did not work. 
the data did not get ingested when i place the props inside the fwder

inputs @fwder
[monitor:///opt/logs/input.csv]
index=test
sourcetype = test_log
disabled = 0

props @fwder 

[test_log]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...