Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Not automatically recognizing fields
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have data that is not being recognized. A PowerShell script outputs data (that I copied to a file for testing) that looks like this:
Identity = MAILHUB2\45191, DeliveryType = SmtpRelayToTiRg, Status = Ready, MessageCount = 0
Identity = MAILHUB2\45210, DeliveryType = MapiDelivery, Status = Ready, MessageCount = 0
Identity = MAILHUB2\45226, DeliveryType = MapiDelivery, Status = Ready, MessageCount = 0
Identity = MAILHUB2\45235, DeliveryType = MapiDelivery, Status = Ready, MessageCount = 0
I formatted the PowerShell output like what I saw in the manual, which described the formatting as "Splunk loves these files. It eats them like jam (or chocolate)", from http://www.splunk.com/base/Documentation/latest/AppManagement/Getdata.
Well it doesn't like that formatting! I've played with this endlessly, changing commas, replacing = with :...no luck.
Splunk idexes it like this:
1
11/25/10
1:56:07.000 PM
geCount = 0
host=localhost Options| sourcetype=access_combined Options| source=script Options
2
11/25/10
1:56:07.000 PM
Identity = MAILHUB1\Submission, DeliveryType = Undefined, Status = Ready, Messa
host=localhost Options| sourcetype=access_combined Options| source=script Options
3
11/25/10
1:56:07.000 PM
Count = 0
host=localhost Options| sourcetype=access_combined Options| source=script Options
Please help! Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured it out. I tried doing it as CSV, where the first line contains the column headings. I set the script sourcetype to csv-4. Here's the powershell formatting:
write-host "Identity, DeliveryType, Status, MessageCount"
$output = $queue.identity.ToString() + ", " + $queue.deliverytype + ", " + $queue.status + ", " + $queue.MessageCount
$output
Splunk now recognizes the field names, and I can alert on when my queues fill up...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should either put timestamps in your data, or set DATETIME_CONFIG = CURRENT for your sourcetype.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured it out. I tried doing it as CSV, where the first line contains the column headings. I set the script sourcetype to csv-4. Here's the powershell formatting:
write-host "Identity, DeliveryType, Status, MessageCount"
$output = $queue.identity.ToString() + ", " + $queue.deliverytype + ", " + $queue.status + ", " + $queue.MessageCount
$output
Splunk now recognizes the field names, and I can alert on when my queues fill up...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The data has a new line for each piece of data, I'm not sure why it's not formatted like that above. Each line starts with Identity
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
