I am monitoring a file that has comma separated values. For example: John, Smith, Maine
The data is being forwarded by a Universal Forwarder. I have the props.conf and transforms.conf set up to receive the data as: firstname, lastname, state
When I search in Splunk -- firstname=John, lastname=Smith, state=Maine
Here's the problem, the order of the data can change in the file, so my fields contain the wrong type of data. Is there a way to
to have the data follow its order dynamically? There is a header that is sent that tells me when the order changes.
Check out indexed_extractions and leverage these new options to extract the structured data fields. NOTE: The indexed_extractions = CSV settings from props.conf are used on the FORWARDER. This method will always ensure that the fields are extracted correctly every time based on the header in the file.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Extractfieldsfromfileswithstructureddata
doesn't the indexed_extractions do indexed time extraction, which I see in lots of documentation to avoid?