Getting Data In

Where do INDEXED_EXTRACTIONS happen?

joxley
Path Finder

I have a Universal Forwarder reading data in a Tab Separated format. I want to apply the INDEXED_EXTRACTIONS = TSV to it.

Do I need to put that on the Indexer or the Forwarder?

A further question is that if the file is being appended to and the top line contains the headers, do I have to wait for the file to be rotated before I'll get the field extractions?

1 Solution

woodcock
Esteemed Legend

You have to put this on every Forwarder and then restart all splunk instances there; read about this caveat here:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime#Caveats

View solution in original post

woodcock
Esteemed Legend

You have to put this on every Forwarder and then restart all splunk instances there; read about this caveat here:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime#Caveats

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!