Our production environment just upgraded to 6.2.5 from 6.0.3. The new data inputs seem to be pretty straight forward, except the index and sourcetype options are fairly limited. I will explain what I mean.
Data inputs in 6.0.x had the functionality to manually add a sourcetype. This was a nice feature because we have some props configurations out there to specifically parse the CSV file that I want to manually index for that sourcetype. For the index, I am unable to find it in the list. The only index names I can see are those that come "out of the box" (index=main, index=os, index=Default, etc. ). I also tried changing around the app context, however the list of indexes stays the same.
I am going in to Data Inputs-->Files & directories(local)-->New-->. From here I want to index a file once, and provide the directory and file name. Next, manually add a sourcetype that goes back to the props we have. It looks like most of the configurations needed should be done right in the UI instead?
As a work around, we can add an inputs.conf that monitors the local directory and tie it back to props.conf , but it would help to know how we could continue to manually add a csv with the correct index and manually add sourcetype if possible. If it helps, here are the configs I have tied to the data in the CSV:
props.conf
[oms_invoice]
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=15
DATETIME_CONFIG=/etc/apps/contract_props/default/oms_invoice_data_datetime.xml
SHOULD_LINEMERGE=false
EXTRACT-oms_invoice=(?<Date>[^,]*),\s*(?<Time>[^,]*),\s*(?<Division>[^,]*),\s*(?<Customer>[^,]*),\s*(?<BillTo>[^,]*),\s*(?<DiversityCustomer>[^,]*),\s*(?<InvoiceTypes>[^,]*),\s*(?<EDI>[^,]*),\s*(?<PDV>[^,]*),\s*(?<PAPER>[^,]*),\s*(?<InvoiceNumber>[^,]*),\s*(?<InvoiceAmount>[^,]*),\s*(?<OrderNumber>[^,]*),\s*(?<OrderLink>.*)
Any insight would be appreciated.
Thanks in Advance!
... View more