Getting Data In

New index not working

iamniks
Explorer

I have created a new index and when i search that in search head its not working.

inputs.conf

[monitor:///apps/splunk/var/run/splunk/fprsbatch.csv]
host = vc2cmmkb019694n.fmr.com
source = bhav
sourcetype = bhav_stype
index = transactions

props.conf

[source::bhav]
REPORT-transactions = fprsbatch_csv
MAX_DAYS_AGO = 10000
SHOULD_LINEMERGE = False

transforms.conf

[fprsbatch_csv]
DELIMS = ","
FIELDS = "ODATE","0TIME","TRANS","AMOUNT"

I have restarted the server once (its a free version)

Tags (2)
0 Karma

iamniks
Explorer

FOund out the issue. there were ^M chars in the input file

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...