hi
my inputfile looks like
empid|name|age
356102|tutun|27
365771|king|28
i have configured props.conf file and transforms.conf in location C:\Program Files\Splunk\etc\system\local which is as below:
**props.conf**
[text]
NO_BINARY_CHECK = 1
KV_MODE=none
SHOULD_LINEMERGE=false
REPORT-comment=Extract_text
**transforms.conf**
[Extract_text]
DELIMS= "|"
FIELDS= "empid","name","age"
but after restarting splunk i am not getting the fields empid,name and age getting extracted in splunk web interface on left panel
can any one help on this becuase my requirement is to make log data in table format using table query in
web interface
I believe that your inputs.conf needs to reference a sourcetype. The sourcetype is the classification of your data.
http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter
In props.conf you have a stanza with [text] therefore the sourcetype set for your input should have:
[default]
host = 01HW447731
sourcetype=text
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf
[
* This stanza enables properties for a given
* A props.conf file can contain multiple stanzas for any number of different
* Follow this stanza name with any number of the following attribute/value pairs, as appropriate
for what you want to do.
* If you do not set an attribute for a given
1.
2. host::
3. source::
4. rule::
5. delayedrule::
classification rule.
These are only considered as a last resort before generating a new source type based on the
source seen.
inputs.conf on the host you got this data from, please.
location for inputs.conf is C:\Program Files\Splunk\etc\system\local
inputs.conf looks like
[default]
host = 01HW447731
Try putting a space between FIELDS so it looks like this:
FIELDS = "empid", "name", "age"
http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf
location C:\Program Files\Splunk\etc\system\local
inputs.conf looks like
[default]
host = 01HW447731
do i need to change it??
Can you add your inputs.conf settings to your original question as well.