Hi,
I am importing custom CSV files. I have a field value named "color". I just want to be able to get Splunk to return the value of color. The example below would return "Orange"
Any ideas what the searh might be?
06/03/2012 09:30:00,DX2-MARTINI-GROC-9,80,COM-LIVE / COM-LIVE2 / SECURE-SSL-LIVE,6509-MK2:ACE:1:MK-ACE-16509-MK1:ACE:1:MK-ACE-1,Down,Down,MARTINI-GROCERY-LIVE,,,,Orange,2,9
If the sourcetype is "csv", then Splunk will extract the fields and name them based on the first line (which is assumed to be a header). So if the first line defined this field with the name Color, you could do this
Would return only the color field for each search result.
If the sourcetype is "csv", then Splunk will extract the fields and name them based on the first line (which is assumed to be a header). So if the first line defined this field with the name Color, you could do this
Would return only the color field for each search result.
Excellent, much appreciated