- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Examples using kvform?
Does anyone know of any examples of using the kvform
search command. The kvform docs seem a bit sparse to me, and I haven't been able to locate any working examples. I'd like to see examples including input files and all configs involved and their locations relative to an app folder.
The docs are unclear on a few points:
- What location should the form files be placed? (The docs talk about
$PLUNK_HOME/etc/apps/.../form
, but does that mean there's a folder called "form"? is it located underlocal
ordefault
.). I assume '...' is the app name. - Can you only extract one field at a time using the kvform search command?
- Is it possible to setup automatic extraction for a specified sourcetype via props?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I am pretty sure it is broken.
Screen shot here:
https://www.dropbox.com/s/3f4rj7468qoilln/Screenshot%202015-04-16%2007.29.02.png?dl=0
Sample app here:
http://d.pr/f/wF95
To replicate, import the sample data, ensure you are in the kvform_example app, and run this search:
source="students.txt" | kvform form=students
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I will fourth that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I will third that. Some documented examples would be nice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'd be interested to see this expanded out too. The documentation & examples are definitely lacking.
