Getting Data In

Need to ingest structured data

New Member

Hi Team,

I need to ingest the structure data but the file is not in csv format. however data inside it is structured. below is the log format which i want to index. can anyone help me with the instruction how we can do this.

#Fields: event,computer,operator,source,sourceid,executionid,starttime,endtime,datacode,databytes,message
PackageStart,pppep2413,MS\test,Spettl_tset,{43474344gfg94341B9-4186-gfC4-102E3fgfg0},{cgfgfg-bgfdf-4FFA-gggg-0C57996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,Beginning of package execution.
OnPreExecute,pppep2413,MS\test,Spettl_tset,{43474344E55-94341B9-4186-B5C4-C1fgfgfgfg0},{fgdfgdf-ggfgfD-gdf-A679-0C546CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
OnPreExecute,pppep2413,MS\test,Get Trigger ID,{4A50954F-137E-4CDD-A20F-fgfg},{fsdfgfgfsdf5-CedD-4FFA-A679-0436CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
g
0 Karma

Revered Legend

See this. (even though file extension is not CSV, data is, so you'd need to create a custom sourcetype with field extraction configuration mentioned in below link)
https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/Data/Extractfieldsfromfileswithstructureddat...

You may have to remove #Fields: from the data, so look for [ExtractCorrectHeaders] in above link.

0 Karma

New Member

Thanks @somesoni2 I was following this document but still confused how to start. would it be possible for you to share one example for me to create props and input with above data to remove #Fields:

0 Karma

Revered Legend

Give this a try (on your forwarder)

[YourSourcetypeHere]
FIELD_HEADER_REGEX=\#Fields\:\s(.*)
FIELD_DELIMITER=,
TIMESTAMP_FIELDS = starttime
0 Karma