Getting Data In

Indexed time extraction for Pipe Delimited

renzgujian
Loves-to-Learn Lots

Hi guys, I have a monitored CSV file that is Pipe delimited


I was trying to extract the fields so that header1 will be a field header, and that value1 and valueA will be the values extracted under it.
However currently I'm getting  3 events where each line is a single event

I have 2 query,
1) do i have to do a props + transform? or will just a props suffice?
2) Where do I place this props.conf? I see that for Indexed_Extraction i have to put it as UF level?

Sample Logs
header1|header2|header3|header4|header5
value1|value2|value3|value4|value5
valueA||valueC||valueE

 

Current Props (not working)

[sourcetypeA]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

Labels (4)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @renzgujian 

Place the props.conf on UF (forwarder) and restart. 

---

An upvote would be appreciated if it helps!

0 Karma

renzgujian
Loves-to-Learn Lots

@venkatasri i have tried that, it did not work. 
the data did not get ingested when i place the props inside the fwder

inputs @fwder
[monitor:///opt/logs/input.csv]
index=test
sourcetype = test_log
disabled = 0

props @fwder 

[test_log]
CHARSET=UTF-8
FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv
KV_MODE=none
SHOULD_LINEMERGE=false
category=Structured
disabled=false
pulldown_type=true

 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote  If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...