Splunk Search

Event breaking to middle text at index time

Dov1
Observer

Hello,

I have some text I indexing, In the middle I have csv table, and some information at end, look like this

Text text text text.

#begining of csv#

Aa,BBC,cc,dd

22,1,444,2

44,22,11,3

#end of csv#

Text text text

How to index only the lines in the csv as events

Thank you

Dov

Labels (1)
Tags (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Unless the csv data is in some distinct easy distinguishable format, there's no way to filter out events based on other events. Events go through ingestion pipeline one at a time and there is no global state you can rely on (to remember whether you already met the header or footer of the data part). With small chunks of this csv data you could try to do some magic involving event breaking so that input is broken on the csv header but it'd be highly ineffective and prone to errors. And you'd get a single event consisting of whole csv content, not separate csv lines and that's probably not what you want.

I'd go for scripted/modular input but that requires some development.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...