About sourabhguha

sourabhguha · ‎10-30-2013

Hi Ayn, did the above information help with understanding the root cause of the issue?

ShaneNewman · ‎10-27-2013

go to the search bar and pipe your main search to | extract getcsvfields Does that extract the fields correctly?

Ayn · ‎10-27-2013

Setup a delimiter based field extraction in props.conf / transforms.conf. In props.conf, you put something like: [yoursourcetype] REPORT = getcsvfields And in transforms.conf: [getcsvfields] DELIMS = "," FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG

ihuzaifazahoor · ‎02-03-2020

Try to change preset value to All Time,Try to change your preset to All Time

sourabhguha · ‎03-23-2013

thanks! that resolved the issue. I renamed it to OMObjectname (removed the '-', did not use underscore).

sourabhguha · ‎03-24-2013

hi Vince, i did reindex my data with the option you suggested and it worked. thanks for your help!

Posts	13
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎03-21-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk not indexing data for files

No results showing up in search after adding sourc...

Creating fields based on a comma seperated list of...

Data not showing up in search

Extracted fields not showing up in Interactive sea...

Splunk treating multiple lines as one event since ...

Re: Splunk not indexing data for files

Re: No results showing up in search after adding s...

Re: Creating fields based on a comma seperated lis...

Re: Data not showing up in search

Re: Extracted fields not showing up in Interactive...

Re: Splunk treating multiple lines as one event si...