Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Extract data from text file without Headers
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Extract data from text file without Headers
I have a text with values separated by spaces.This file does not have any headers. I need to add headers to this file and use this file in splunk. I can not manually do that as I will be getting a similar file every 15 minutes daily. Is there any way to do it using field extraction or something else in splunk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The inputs.conf file needs to be on the forwarder that is monitoring the log directory. The props.conf and transforms.conf should be in the splunk\etc\system\local\ directory of the indexer. If those files don’t exist, then create them – make sure they have a .conf extension and not a .conf.txt extension.
You may need to further refine the configs, but if so you’ll need to provide more information.
inputs.conf
[monitor://blankpathtofiledirectory]
disabled = false
index = default
sourcetype = yourblanksourcetype
props.conf
[yourblanksourcetype]
SHOULD_LINEMERGE = false
TIME_FORMAT = blank
MAX_TIMESTAMP_LOOKAHEAD = blank
REPORT-spaced = spacedfields
transforms.conf
[spacedfields]
DELIMS = “ “
FIELDS = list of comma separated fields
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So the person asking the question knows where information is missing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
why the explicit use of 'blank'?
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you post the header, or some obfuscated reference header that you'll understand when we stick it in a configuration example?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah header will always be the same
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, please let me know if this can be done from splunk forwarders or do we need to go to splunk searchhead.Please let me know in case I need to do any changes from splunk UI as well
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Space separated files are easy to index if the files all have the same field composition.
If you could put a header in every file, would it always be the same header? If so, post it.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...
July Community Events: Master ITSI 5.0 & Automate Splunk
New Release of Federated Search: Bringing Splunk Analytics to More of Your Data
