I am uploading my_file.txt in splunk under sourcetype TARGET_ONE.The content of my file is Fname|Mname|Lname|age|location abhay|vikram|singh|26|kolkata murari|kumar|bhartia|25|Bangalore
for field extraction I have defined props.conf and transform.conf as following:
NO_BINARY_CHECK = 1
pulldown_type = 1
DELIMS = "|"
FIELDS = "Fname","Mname","Lname","age","location"
but should i define it in props.conf and transform.conf before defining in splunk-web sourcetype??
can any one teel is there any wrong with code because i want to avoid regex i want extarct all fields with Delims.
If some one provide me with some code detais it wiil be helpful as my final objective is to bring my_file data as tabular format writing table quiery in search time??
Editing the props.conf and transforms.conf directly is the same as using the splunk-web interface to define sourcetypes and transforms. However the splunk-web interface does NOT give you the ability to use some of the more advanced setttings/stanzas. Another thing to note is by edit throught he splunk-web interface you are NOT required to restart splunk, by edit the files directly splunk sometimes requires a restart for your changes to take effect.
With regards to your transforms and props file don't see any cause for alarm and it should work just fine, but I can only really guess since your sample is fairly small. I will say that the pulldown_type is an Internal Settings that specifies "NOT YOURS. DO NOT SET".
then for extraction can i set
CHECK_FOR_HEADER=TRUE (for automating extraction header)
then for extraction i have to write in props.conf only.
actual file size is very bug and it conatin 25 fields with delimiter "|"
I agree with Ayn. After many conversations with Splunk staff, they recommend doing all field extraction in search-time. TRANSFROM is an Index-time operation and has performance implications. Also creates additions to
Splunk's default set of indexed fields. Moding those defaults can have all types of unintended results.
The TRANSFORMS directive is for index-time extractions. These should not be used unless absolutely necessary, and only by people who really know what they're doing. Use REPORT for search-time extractions.