Getting Data In

tab delimited file not getting split in the indexer

hemanthhebbursh
New Member

Hi
I am new to splunk
Am trying to split Tab delimited file in the indexer .
Below are the entries of the different config files .
In spite of these the data that gets ingested in splunk is not split by field names .

What am i doing wrong ?

alt text

Entries :
/opt/apps/splunkforwarder/etc/apps/DtuApp/local>vi props.conf

[SplunkJobLog_csv]
SHOULD_LINEMERGE = False
pulldown_type = 1
REPORT-myname = getJobLogData




[SplunkDbLog_csv]
SHOULD_LINEMERGE = False
pulldown_type = 1
REPORT-myname = getDbLogData

/opt/apps/splunkforwarder/etc/apps/DtuApp/local>cat transforms.conf

[getJobLogData]
DELIMS = "\t"
FIELDS = "ORDERID","JOBNAME","TYPE","ODATE","STATE","STATUS","FILENAME","APPLICATION","SUBAPPLICATION","STARTED","ENDED","TIME_OF_LOG_GEN"

[getDbLogData]
DELIMS = "\t"
FIELDS = "coord_member","application_handle","application_name","session_auth_id","client_applname","elapsed_time_sec","activity_state","activity_type","total_cpu_time","total_cpu_time_ml","rows_read","rows_returned","query_cost_estimate","direct_reads","direct_writes","stmt_text","ts"

/opt/apps/splunkforwarder/etc/apps/DtuApp/local>cat inputs.conf

[default]
host=xxxxxxx
[monitor:///data/logs/splunk_logs/Job_status_logs/*.log]
_TCP_ROUTING = DtuSplunk
disabled=false
index = 140868736_dtu_idx3
sourcetype=SplunkJobLog_csv
crcSalt = <SOURCE>

[default]
host=xxxxxxxxx

[monitor:///data/logs/splunk_logs/Other_logs/*.log]
_TCP_ROUTING = DtuSplunk
disabled=false
index = 140868736_dtu_idx3
sourcetype=SplunkDbLog_csv
crcSalt = <SOURCE>

Output.conf

  [tcpout]
    defaultGroup=DtuSplunk
    [tcpout:DtuSplunk]
    server= <splunk_ip>:13938
    useACK = true 
Tags (1)
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @hemanthhebburshekar,

Please try to configure props.conf on Universal Forwarder only with below config and remove other configuration files.

props.conf

[SplunkJobLog_csv]
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = "ORDERID","JOBNAME","TYPE","ODATE","STATE","STATUS","FILENAME","APPLICATION","SUBAPPLICATION","STARTED","ENDED","TIME_OF_LOG_GEN"

[SplunkDbLog_csv]
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = "coord_member","application_handle","application_name","session_auth_id","client_applname","elapsed_time_sec","activity_state","activity_type","total_cpu_time","total_cpu_time_ml","rows_read","rows_returned","query_cost_estimate","direct_reads","direct_writes","stmt_text","ts"

and then restart splunkforwarder.

EDIT: Updated props.conf configuration.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...