I am running into an issue with my transforms and props config files, my data is being logged properly to my index but when I set my fields in the transforms.conf it only takes everyother fieldname. Below are my transforms.conf stanza with the work-around I have implemented and my props.conf, clearly this is a bad method and i am trying to figure out why splunk would be taking everyother fieldname
[mySourcetype] DELIMS = ", " FIELDS = "timestamp", "", "levelname", "", "someid", "", "somecode", "", "someothercode", "", "someotherid"
That empty double bracket is the only way for my logs to be formatted properly.
[mySourcetype] TRUNCATE = 0 MAX_EVENTS = 10000 MAX_TIMESTAMP_LOOKAHEAD = 60 SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%d %H:%M:%S REPORT-mySourcetype = mySourcetype BREAK_ONLY_BEFORE = TIMESTAMP KV_MODE = auto given_type = csv
It looks like you have both a comma and a space in your
DELIMS = ", "
So you are telling Splunk that both a comma and a space are a delimiter. If your data looks like this
Mary, 12345, Utah Pat, 98765, Virginia
Then perhaps Splunk is seeing the data like this
DELIMS = ","
Also, as others have suggested, a sample of your data would also be very helpful.
props.conf, I think you should set
KV_MODE = none
since you are explicitly extracting the fields in
transforms.conf - And Very Important:
YOU SHOULD NOT SET
given_type, so remove
given_type = csv
removing the space from my DELIMS stanza fixes one problem but then because my data is quoted and separated by commas the data is coming into Splunk with the quotes. This causes me to have to use a escape character to run any search. For example:
This is how I would have to run a search