I have an index where I have indexed a csv file with 7 fields. Following is the format of csv file. (header row)
timestamp,field1,field2,field3,field4,field5,field6
Since the fields were not automatically extracted, I 'Extract field' options of Splunk to do the same. Exception for field5, all other field extractions are working fine. For field5, I validated the regular expression generated by Splunk and it works perfectly with search (using rex command), but not with Field extraction:
EXTRACT-Field5=(?i)^(?:[^,]*,){5}(?P<Field5>[^,]+)
Anyone has any idea if this is a possible bug with Field Extraction or any better way to extract fields from csv file. Splunk version is 5.0.5.
The best way would probably be to use a REPORT with DELIMS and FIELDS, instead of an EXTRACT;
props.conf
[your_sourcetype]
REPORT-blah = extract_csv_blah
transforms.conf
[extract_csv_blah]
DELIMS = ","
FIELDS = fieldname1, fieldname2, fieldname3, fieldname3, fieldname4, fieldname5, fieldname6, fieldname7
Read more in the docs for transforms.conf;
http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Transformsconf
Hope this helps,
K
The best way would probably be to use a REPORT with DELIMS and FIELDS, instead of an EXTRACT;
props.conf
[your_sourcetype]
REPORT-blah = extract_csv_blah
transforms.conf
[extract_csv_blah]
DELIMS = ","
FIELDS = fieldname1, fieldname2, fieldname3, fieldname3, fieldname4, fieldname5, fieldname6, fieldname7
Read more in the docs for transforms.conf;
http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Transformsconf
Hope this helps,
K
This seems to solve the issue. Thanks Kristian...