Hello, I was trying to write PROPS configuration file following sample events...
2021-06-08T13:26:53.665000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462|
2021-06-08T13:26:54.478000-04:00|PGM|mtb1120ppcdwap6|vggtb|26462|
since it has pipe "|"..here is what I wrote..but not working... Any help will be highly appreciated...thank you so much..
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
INDEXED_EXTRACTIONS = psv
TIME_FORMAT = %Y%m%d %H:%M:%S:%Q
TIMESTAMP_FIELDS = TIMESTAMP
How are you onboarding this data?
If you are onboarding this data from a remote server using UF, you should place the props.conf on the remote server to extract the fields.
Its always better to test the extraction using UI i.e. settings -> Add Data -> upload -> choose psv as sourcetype. Once you are ok with extraction, copy the parameters deploy it over to the UF.
If this psv file does not has a header file, you need to mention the fields as well in the props.conf.
-- Hope this helps.