Getting Data In

Wrong indexed fields.

spisiakmi
Communicator

Hi,

I want to index this csv file:

run_time;field1;field2;field3;field4;field5;field6;field7;field8;
80s;"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;

inputs.conf is

[monitor://\\srv\Log Sicherung\]
disabled = false
index = machinedata_w48
sourcetype = systest
crcSalt=<SOURCE>
ignoreOlderThan = 24h

and props.conf is

[systest]
BREAK_ONLY_BEFORE_DATE = 
CHARSET = WINDOWS-1252
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

In splunk will be indexed only
run_time;field1
and the field1 with the value:

"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;

Can you help me, please, how to solve this problem? I want to have indexed all fields* with proper values (separated with ;).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You've told Splunk the fields are separated by commas yet there are no commas in the data. That's why everything ends up in one field.

Try these props.conf settings:

[systest]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
FIELD_DELIMITER = ;
HEADER_FIELD_DELIMITER = ;
---
If this reply helps you, Karma would be appreciated.
0 Karma

spisiakmi
Communicator

Hi richgalloway. Thank you for your reaction. Unfortunately it didn't work. Nothing changed.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...