Need to ingest structured data

[csharm21]

Hi Team,

I need to ingest the structure data but the file is not in csv format. however data inside it is structured. below is the log format which i want to index. can anyone help me with the instruction how we can do this.

#Fields: event,computer,operator,source,sourceid,executionid,starttime,endtime,datacode,databytes,message
PackageStart,pppep2413,MS\test,Spettl_tset,{43474344gfg94341B9-4186-gfC4-102E3fgfg0},{cgfgfg-bgfdf-4FFA-gggg-0C57996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,Beginning of package execution.
OnPreExecute,pppep2413,MS\test,Spettl_tset,{43474344E55-94341B9-4186-B5C4-C1fgfgfgfg0},{fgdfgdf-ggfgfD-gdf-A679-0C546CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
OnPreExecute,pppep2413,MS\test,Get Trigger ID,{4A50954F-137E-4CDD-A20F-fgfg},{fsdfgfgfsdf5-CedD-4FFA-A679-0436CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
g

[somesoni2]

See this. (even though file extension is not CSV, data is, so you'd need to create a custom sourcetype with field extraction configuration mentioned in below link)
https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/Data/Extractfieldsfromfileswithstructureddat...

You may have to remove #Fields: from the data, so look for [ExtractCorrectHeaders] in above link.

[csharm21]

Thanks @somesoni2 I was following this document but still confused how to start. would it be possible for you to share one example for me to create props and input with above data to remove #Fields:

[somesoni2]

Give this a try (on your forwarder)

[YourSourcetypeHere]
FIELD_HEADER_REGEX=\#Fields\:\s(.*)
FIELD_DELIMITER=,
TIMESTAMP_FIELDS = starttime