i've followed the documentation and also some examples on here but for some reason I cant seem to get these to extract
here is an example of the log
xxx localhost 9997 8003 test test endRequest 2266 2022-11-17T08:08:06.617 2022-11-17T08:08:06.640 23 0 - OK - - DESC EXTENDED VIEW test_data_imp DESC - Denodo-Scheduler JDBC 127.0.0.1 - -
the props are as follows
REPORT-denodo-vdp-queries-fields = REPORT-denodo-vdp-queries-fields
the transforms are as follows
DELIMS = "\t"
FIELDS = "server_name","host","port","id","database","username","notification_type","sessionID","start_time","end_time","duration","waiting_time","num_rows","state","completed","cache","query","request_type","elements","user_agent","access_interface","client_ip","transaction_id","web_service_name"
i've pushed the app to the forwarders that sending in the data and its in the right sourcetype, i've also pushed the app across the SH cluster, however none of the fields are extracted, am i missing a step?
First, are you sure the delimiter is the tab character and not white space in general?
Second, you say you pushed the app to the forwarders, but are they universal or heavy forwarders? If the former then the props will have no effect and must be pushed to the indexers.
Thanks for the response, when i extract them using the gui and "Extract Fields" tab delimeter option does pick the fields out correctly. I thought that if we put the app across the search head it would extract them at search time, not at index time?
My mistake. Yes, REPORT transforms are performed at search time and as such should be pushed to search heads.
Remove the quotes from the DELIMS setting. The value of DELIMS is a regular expression rather than a quoted string. Since your data does not contain quotes then the regex should not, either.
Thanks for your reply, I have tried this and for some reason its not working, I cant work out at all why this isnt working. I've also tried to write regex for the transforms which works fine in regex101 but again doesnt extract.
I have found the following errors, so it looks like the transforms isnt being detected in splunk, do i need to make them global or something like that?