Hi my input file looks like
nn,00390493,9,"Monday, October 8, 2012 12:24:31 UTC",39.7152,-119.4563,1.0,10.90, 5,"Nevada"
us,c000d3t1,5,"Monday, October 8, 2012 12:20:52 UTC",-4.4803,129.2248,4.8,34.90,60,"Banda Sea"
us,c000d3sw,7,"Monday, October 8, 2012 12:18:47 UTC",44.1363,17.1806,4.4,11.60,47,"Bosnia and Herzegovina"
I am configuring my transforms.conf as
FIELDS="Src", "Eqid", "Version", "Datetime", "Lat", "Lon", "Magnitude", "Depth", "NST", "Region"
then runninng query after saving it in index quak like
index-"quak"| extract access-extraction
but the filed is not getting extracted error coming as
Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'access-extraction'.
[EventsViewer module] Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'access-extraction'.
can anyone help me to resolve the issue??
I'm not sure what exactly is happening here, but I have some things to try. First, I see that you invoked the extraction explicitly in your search. Do you get the same error message if you invoke the extraction via props.conf? To test, put the following stanza in a props.conf file (which must be in the same directory as your transforms.conf):
[yoursourcetypehere] REPORT-r1=access-extraction SHOULD_LINEMERGE = false TIME_FORMAT = %a, %b %d, %Y %H:%M:%S %Z
I added a couple of settings here (SHOULD_LINEMERGE and TIME_FORMAT) that may not be needed. However, SHOULD_LINEMERGE=false will speed up the parsing.
I am also unsure whether Splunk is going to respect the quoted strings in the input data. This would make the Datetime into three fields: day of week, month+day, year+time+tz. Ugly, but still workable. The quotation marks might also end up as part of the fields... So, you could also try this for your transforms.conf, just to test
[access-extraction] DELIMS="," FIELDS=Src, Eqid, Version, Datetime1, Datetime2, Datetime3, Lat, Lon, Magnitude, Depth, NST, Region
(Note that quotes around the field names are not required.)
BTW, I hope that all your data in is UTC. Otherwise, check carefully as I am not sure that the %Z specifier for timezone will always work properly. And there are some ambiguities in the 3-character timezone specifiers.
So what error message do you get when using props.conf - is it the same as the message that you get from the extract in the search panel?
Also, after you created the entry in transforms.conf, did you restart Splunk?