Hello,
we are trying to parse an html file to splunk.
We tried it two different ways:
one way was to use the splunk "Website Input" app, the other was to upload the html file.
Both ways werent really working as we expected.
The problem is how to pars the table fields logically. If we use the Website Input we are just able to seperate the fields by different code Points for example the or tag in the table. but if we do so we get fields with the values of a hole line and we have a stats file with hundrets of rows. for example after a Website Input we get a field "field1=Action1 1 12.500 00.016 00.016 00.016 1 100.00 0 0.00 0 0.00 0 0.00 0 0.00 0 0.00" and we would get more than 150 fields in our stats html file. Also the statsfile does not have everytime the same Count of rows depending on the stats, that means field26 is on one day like "field26=Action25 20 20..." and on the other day ist like "field26=Action20 15 10...." so we couldnt say fieldXX=ActionXX everytime...
If we just upload the file we werent able to seperate all the fields. We just get one event with the hole code.
The main Problem is that we would like to have an own event for every row in the tables. As we have more than one table which have different designs it would be much easier if there is a way to force splunk to index one event for each row.
Is there a possibility to Show splunk that this is a table and how to index this table line by line. If this would be possible we could just do a simple field extraction an thats it.
thanks very much
