Monitoring Splunk

Splunk does not detect pipe separated headers

awagner
Explorer

Hi All,

I am trying to load files with headers. The files are simple pipe-separated files. I use the following in props.conf:

FIELD_DELIMITER="|"

In this case, the file is indexed, but the fields are not shown.

If I omit the ", like this:

FIELD_DELIMITER=|

the file is not indexed at all.

If I change all pipes to commas in the input file, and use

FIELD_DELIMITER=,

the file gets indexed, and the fields are all there.

Is there a way to get Splunk load pipe separated files? I don't want to define the fields in transform, because they keep changing from file to file.

Thanks,
Ambrus

Tags (2)

yannK
Splunk Employee
Splunk Employee

Take a look at the new header field extraction since version 6.*.

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime

try an escape character before
FIELD_DELIMITER = \|

awagner
Explorer

I tried the backslash | version, still nothing.

0 Karma

awagner
Explorer

I also tried INDEXED_EXTRACTIONS = PSV, but no change.

0 Karma

awagner
Explorer

Now I have this in props.conf:

FIELD_DELIMITER = "|"
HEADER_FIELD_DELIMITER = "|"
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1

Still no luck. The file is indexed, but the fields are not there.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...