Getting Data In

Parsing pipe delimiter with props.conf and transforms.conf not working

mlovasco
Explorer

Hi - trying to parse 2 similar sourcetypes with props.conf and transforms.conf but they are not working.  Help would be appreciated! Thanks!

Example events:

sourcetype=avaya:epm:mpplogs

@2021-11-19 09:41:54,070|PAVB_03335|INFO|VB|650636|Session=aipor-mpp001lv-2021323144040-7|Got VoiceXML exception: noinput in 9b99c62c5d35f81d18e547137018bef9663c3bc7a33f60a3f25aa4d55d36e14f|aipor-mpp001lv####

sourcetype=avaya:epm:vpmslogs

@2021-11-19 09:51:10,411 EST||FINE|AppIntfService|VoicePortal|ajp-nio-127.0.0.1-3009-exec-41|Method=PackageInfo::GetBuildVersion()| attempt to locate file on classpath. File = VPAppIntfService.aar|||||||aipva-epm001lv|4000064385####

 

props.conf

[avaya:epm:mpplogs]
REPORT-pipe-separated-fields-mpp = pipe-separated-fields-mpp

[avaya:epm:vpmslogs]
REPORT-pipe-separated-fields-vpms = pipe-separated-fields-vpms

 

transforms.conf

[pipe-separated-fields-mpp]
DELIMS = "|"
FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventId","eventText","eventDescription","serverName"

[pipe-separated-fields-vpms]
DELIMS = "|"
FIELDS = "eventTimestamp","eventName","eventLevel","triggerComponent","eventMonitor","eventDescription"

(I've tried with and without quotes)

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There's the problem.  Parsing with these settings happens at search time so the settings need to be on the search heads.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

mlovasco
Explorer

Yes, testing with verbose mode... none of my fields are appearing.

Should also mention that I'm Cloud, but my app is on a deployment server and being successfully deployed to appropriate clients.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are you testing this?  Are you using Verbose mode?

---
If this reply helps you, Karma would be appreciated.
0 Karma

mlovasco
Explorer

Yes, testing with verbose mode... none of my fields are appearing.

Should also mention that I'm Cloud, but my app is on a deployment server and being successfully deployed to appropriate clients.

Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Wait a second. To which clients are you deploying this app?

0 Karma

mlovasco
Explorer

Hosts where these logs are located... 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's the problem.  Parsing with these settings happens at search time so the settings need to be on the search heads.

---
If this reply helps you, Karma would be appreciated.

mlovasco
Explorer

Got it... will reroute my thinking.. thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...