Getting Data In

tab delimited file not getting split in the indexer

hemanthhebbursh
New Member

Hi
I am new to splunk
Am trying to split Tab delimited file in the indexer .
Below are the entries of the different config files .
In spite of these the data that gets ingested in splunk is not split by field names .

What am i doing wrong ?

alt text

Entries :
/opt/apps/splunkforwarder/etc/apps/DtuApp/local>vi props.conf

[SplunkJobLog_csv]
SHOULD_LINEMERGE = False
pulldown_type = 1
REPORT-myname = getJobLogData




[SplunkDbLog_csv]
SHOULD_LINEMERGE = False
pulldown_type = 1
REPORT-myname = getDbLogData

/opt/apps/splunkforwarder/etc/apps/DtuApp/local>cat transforms.conf

[getJobLogData]
DELIMS = "\t"
FIELDS = "ORDERID","JOBNAME","TYPE","ODATE","STATE","STATUS","FILENAME","APPLICATION","SUBAPPLICATION","STARTED","ENDED","TIME_OF_LOG_GEN"

[getDbLogData]
DELIMS = "\t"
FIELDS = "coord_member","application_handle","application_name","session_auth_id","client_applname","elapsed_time_sec","activity_state","activity_type","total_cpu_time","total_cpu_time_ml","rows_read","rows_returned","query_cost_estimate","direct_reads","direct_writes","stmt_text","ts"

/opt/apps/splunkforwarder/etc/apps/DtuApp/local>cat inputs.conf

[default]
host=xxxxxxx
[monitor:///data/logs/splunk_logs/Job_status_logs/*.log]
_TCP_ROUTING = DtuSplunk
disabled=false
index = 140868736_dtu_idx3
sourcetype=SplunkJobLog_csv
crcSalt = <SOURCE>

[default]
host=xxxxxxxxx

[monitor:///data/logs/splunk_logs/Other_logs/*.log]
_TCP_ROUTING = DtuSplunk
disabled=false
index = 140868736_dtu_idx3
sourcetype=SplunkDbLog_csv
crcSalt = <SOURCE>

Output.conf

  [tcpout]
    defaultGroup=DtuSplunk
    [tcpout:DtuSplunk]
    server= <splunk_ip>:13938
    useACK = true 
Tags (1)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @hemanthhebburshekar,

Please try to configure props.conf on Universal Forwarder only with below config and remove other configuration files.

props.conf

[SplunkJobLog_csv]
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = "ORDERID","JOBNAME","TYPE","ODATE","STATE","STATUS","FILENAME","APPLICATION","SUBAPPLICATION","STARTED","ENDED","TIME_OF_LOG_GEN"

[SplunkDbLog_csv]
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = "coord_member","application_handle","application_name","session_auth_id","client_applname","elapsed_time_sec","activity_state","activity_type","total_cpu_time","total_cpu_time_ml","rows_read","rows_returned","query_cost_estimate","direct_reads","direct_writes","stmt_text","ts"

and then restart splunkforwarder.

EDIT: Updated props.conf configuration.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...