I'm trying to extract fields from a basic .csv log with no luck.
Here is the file how it looks in Splunk 6.2.5..
When I try to configure a field extraction, Splunk only recognizes the very first instance....
Any help would be greatly appreciated - thanks!
got it....that's the problem, need to break after the carriage return.
1) When you ingest the file, you need to create a new custom sourcetype.
2) in $splunk/etc/apps/search/local .... you'll see that new sourcetype referenced.
3) you need to instruct splunk to break after each line: LINE_BREAKER = ([\r\n]+)
...or the props.conf on the deployment server should work as well....
You did not mention
props.conf in your question so we had to guess. That is why it is important to clearly spell out what you have done so far. No,
max_match is not part of the
props.conf way of extracting fields. I will post another answer.
When you go to production yes, tthe props.conf will then get sent to the forwarder that is collecting the data.
But for now you can test in : in $splunk/etc/apps/search/local .. and local the file a local directory to test...does that make sense?