About R15

R15

@yeahnah I have confirmed the forwarder and indexer are both on 8.0.6. We intend to upgrade but I'd be lucky if it's by the end of the year. With no sourcetype or with the default csv sourcetype the events do not have proper timestamps. So I know my sourcetype is definitely being applied, and it works, it's just throwing out these junk events as well for some reason. I replaced it with the code from @isoutamo and got the same result. I will turn to support for further troubleshooting. Thank you both for your time!

R15

I did some testing before implementing by starting to add a sample directly to an indexer, and the events preview looked good. There were no extra events. I will push your sourcetype code and report back (I'll just replace MAX_DAYS_AGO=9999 with TIMESTAMP_FIELDS=TimeCreated). Our forwarders are running 8.0.6

R15

I've checked and that box was already ticked. I ran that search and there are events when I made changes yesterday and last week. Are we at a dead end?

R15

@yeahnah I've added that line and removed HEADER_FIELD_LINE_NUMBER but to no effect. You mentioned restarting the forwarder which I haven't been doing as I don't have permissions. I've been pushing these changes from a deployment server (which I have full access/control).

R15

I do have access and have looked through a few dozen of them. They all appear normal/identical for the first two lines. I can't copy and paste from that environment so I only typed the first few fields of line 2: #TYPE System.Diagnostics.Eventing.Reader.EventLogRecord "Message","Id","Version","Qualifiers","Level","Task" They're all Windows event logs with the same fields. To reiterate, before I was getting all events correctly plus an additional event containing only line 2. After adding HEADER_FIELD_LINE_NUMBER = 2, I'm still getting that additional event plus another containing only line 1.

R15

props.conf: [sample] SHOULD_LINEMERGE = false pulldown_type = true HEADER_FIELD_LINE_NUMBER = 2 INDEXED_EXTRACTIONS = csv TIMESTAMP_FIELDS = TimeCreated KV_MODE = none category = Structure disabled = false inputs.conf: [monitor://filepath] disabled = 0 crcSalt = <SOURCE> index = index2 sourcetype = sample I've redacted the filepath and changed some names. I'm not currently using any transforms. This is monitoring ~250 csv's that get replaced once a day. It works fine except for the extra events. Thank you for your assistance.

R15

Hi, I found similar questions but the usual solution of using HEADER_FIELD_LINE_NUMBER did not work. My custom csv sourcetype is working fine, except I'm getting an extra event with the column names. Splunk knows they're column names, it's still treating them as fields so the event has Col1=Col1, Col2=Col2 etc. The csv's all start the same, there's an identical line 1 then and identical line 2 which is the column names. After adding HEADER_FIELD_LINE_NUMBER =2 (in props.conf on the forwarder), I'm still getting events with the column names, but now I'm ALSO getting events with just the first line as well. Am I missing something? Thanks

R15 · ‎01-04-2023

@richgalloway I'm new here and still trying to wrap my around this as I prepare to help upgrade and then later expand our setup. It's a very small deployment (for now), 2 indexers which are also search heads with replication between indexers. Would this mean ALL of our saved searches violate the above?

R15 · ‎01-03-2023

Hi, We're preparing to upgrade SE from 8 to 9 and have a question about this requirement: For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions: ... ... They do not run their own saved searches If our indexers are also search heads, would that violate this?

R15 · ‎12-14-2022

Hi, We're preparing to upgrade SE from 8 to 9 and have a question about this requirement: For distributed deployments of any kind, confirm that all machines in the indexing tier satisfy the following conditions: ... ... They do not run their own saved searches If our indexers are also search heads, would that violate this?

Posts	11
Solutions	0
Karma Given	12
Karma Received	0
Member Since	‎12-14-2022

Online Status	Offline
Date Last Visited	a week ago

How to get events for .csv headers?

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

Re: Getting events for .csv headers

How to get events for .csv headers?

Re: Splunk Upgrade Requirement Clarification

Splunk Upgrade Requirement Clarification

Upgrade Requirement Clarification