I am performing the following test in my env,
props.conf
[newcsvtest]
REPORT-newcsvtest = newcsvtest
SHOULD_LINEMERGE = false
TIME_FORMAT = %H:%M:%S
TIME_PREFIX = ^
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
with a corresponding
transforms.conf
[newcsvtest]
DELIMS = ","
FIELDS = field1, field2, field3, field4, field5, field6, field7, field8, field9, field10, field11
and used the following for monitoring the data:
/opt/splunk/bin/splunk add monitor /opt/splunk/etc/apps/sample_app/logs/logtestdata/newcsvtest_log -sourcetype newcsvtest -index _internal
however, the csv file of the following format doesn't get line seperated appropriately
13:05:00,1781,3,3,1785,2,0,0,0,2,20
13:10:00,1781,3,3,1785,2,0,0,0,2,20
13:15:00,1781,3,3,1785,2,0,0,0,2,20
Any help would be greatly appreciated.
Thanks.
