Hi,
I want to index this csv file:
run_time;field1;field2;field3;field4;field5;field6;field7;field8;
80s;"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;
inputs.conf is
[monitor://\\srv\Log Sicherung\]
disabled = false
index = machinedata_w48
sourcetype = systest
crcSalt=<SOURCE>
ignoreOlderThan = 24h
and props.conf is
[systest]
BREAK_ONLY_BEFORE_DATE =
CHARSET = WINDOWS-1252
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1
In splunk will be indexed only
run_time;field1
and the field1 with the value:
"iField_value1":18;"iField_value2":524;"iField_value3":2004;"iField_value4":2;"iField_value5":19;"iField_value6":500;"iField_value7":2004;"iField_value8":21;
Can you help me, please, how to solve this problem? I want to have indexed all fields* with proper values (separated with ;).
You've told Splunk the fields are separated by commas yet there are no commas in the data. That's why everything ends up in one field.
Try these props.conf settings:
[systest]
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
FIELD_DELIMITER = ;
HEADER_FIELD_DELIMITER = ;
Hi richgalloway. Thank you for your reaction. Unfortunately it didn't work. Nothing changed.