Splunk Search

How to configure props.conf and transforms.conf for index-time field extraction from a CSV file?

egsub
Explorer

Hi,

We are trying the index-time field extraction for a specific case, and have no idea about the correct configuration.

Our CSV files contain headers with field names (not configured on forwarders), and we want to extract on index-time 2 fields out of 15.

csv example:
A,B,C,D,E
1,2,3,4,5
10,20,30,40,50
20,30,40,50,60
30,40,50,60,70
(we want to extract on index-time fields B,C)

What should we configure on props.conf and transforms,conf on indexers?

0 Karma

woodcock
Esteemed Legend

Do you really need to do just those 2? The investment involved to do any is nearly identical to the investment involved to do all of them which you can do like this:

INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ","
HEADER_FIELD_DELIMITER = ","
HEADER_FIELD_LINE_NUMBER = 1
TIMESTAMP_FIELDS = 1

Make sure you adjust the TIMESTAMP_FIELDS line (I guessed) and then put this on all of your indexers.

0 Karma

egsub
Explorer

Hi,
Thanks for your reply.
we have already configured these pairs of configurations for timestamp recognition and field names identify.

We want to configure index-time field extraction and indexing in specific index-files for these fields - which configures in "FIELD_NAMES" in this stanza.

0 Karma

woodcock
Esteemed Legend

The solution that I gave at first is done at index-time and if you do not like the names that the CSV file has in the header, you can override them with your preferred names by adding a configuration line like this to the original solution:

FIELD_NAMES = field1name, field2name, field3name, ...

See full details here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Extractfieldsfromfileheadersatindextime

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.