Splunk Search

Creating fields based on a comma seperated list of values

sourabhguha
Explorer

Hi,

I am indexing a set of csv files. the files do not have the header fields in it.

While I am creating the sourcetype, I would like to specify the following fields name for the sourcetype - which is a comma separated list. How can i do that?

tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG,

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Setup a delimiter based field extraction in props.conf / transforms.conf.

In props.conf, you put something like:

[yoursourcetype]
REPORT = getcsvfields

And in transforms.conf:

[getcsvfields]
DELIMS = ","
FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG

View solution in original post

Ayn
Legend

Setup a delimiter based field extraction in props.conf / transforms.conf.

In props.conf, you put something like:

[yoursourcetype]
REPORT = getcsvfields

And in transforms.conf:

[getcsvfields]
DELIMS = ","
FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!