Monitoring Splunk

Splunk does not detect pipe separated headers

awagner
Explorer

Hi All,

I am trying to load files with headers. The files are simple pipe-separated files. I use the following in props.conf:

FIELD_DELIMITER="|"

In this case, the file is indexed, but the fields are not shown.

If I omit the ", like this:

FIELD_DELIMITER=|

the file is not indexed at all.

If I change all pipes to commas in the input file, and use

FIELD_DELIMITER=,

the file gets indexed, and the fields are all there.

Is there a way to get Splunk load pipe separated files? I don't want to define the fields in transform, because they keep changing from file to file.

Thanks,
Ambrus

Tags (2)

yannK
Splunk Employee
Splunk Employee

Take a look at the new header field extraction since version 6.*.

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime

try an escape character before
FIELD_DELIMITER = \|

awagner
Explorer

I tried the backslash | version, still nothing.

0 Karma

awagner
Explorer

I also tried INDEXED_EXTRACTIONS = PSV, but no change.

0 Karma

awagner
Explorer

Now I have this in props.conf:

FIELD_DELIMITER = "|"
HEADER_FIELD_DELIMITER = "|"
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

Still no luck. The file is indexed, but the fields are not there.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...