I updated my answer to include a way to count... ... View more

You should place the lookup file in your app directory, so for example if you are just using the default "search" app you would put it in (assuming Splunk is installed in "Program Files" under D drive: D:\Program Files\Splunk\etc\apps\search\lookups\keywords.csv Or if you have set up your own app, for example "myApp", you would put it: D:\Program Files\Splunk\etc\apps\myApp\lookups\keywords.csv You will also need to create/edit a transforms.conf file in the same directory to tell Splunk to use the lookup: D:\Program Files\Splunk\etc\apps\<appName>\local\transforms.conf And with the contents of (where the file is new): [keywords] filename = keywords.conf You do not need to restart Splunk for this usually. Hope this helps ... View more

can nomv help on this requirement?? ... View more

suppose my filed is like contain both plan and project and i want my found_project column as project,plan what should i do and the second query is not working as macth returns boolean only can u help once againg for this isssue?? ... View more

check is your files are not being skipped because they have the same exact first 256 chars, and therefore are considered as rotated files by the tailing processor. see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/HowLogFileRotationIsHandled to force splunk to consider files are different : use the crcSalt= option to differenciate per filename see http://docs.splunk.com/Documentation/Splunk/4.3.4/admin/Inputsconf or make sure that your files have different patterns on the first line (a timestamp by example) ... View more

So what error message do you get when using props.conf - is it the same as the message that you get from the extract in the search panel? Also, after you created the entry in transforms.conf, did you restart Splunk? ... View more

I believe that your inputs.conf needs to reference a sourcetype. The sourcetype is the classification of your data. http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter In props.conf you have a stanza with [text] therefore the sourcetype set for your input should have: [default] host = 01HW447731 sourcetype=text http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf [ ] * This stanza enables properties for a given . * A props.conf file can contain multiple stanzas for any number of different . * Follow this stanza name with any number of the following attribute/value pairs, as appropriate for what you want to do. * If you do not set an attribute for a given , the default is used. can be: 1. , the source type of an event. 2. host:: , where is the host for an event. 3. source:: , where is the source for an event. 4. rule:: , where is a unique name of a source type classification rule. 5. delayedrule:: , where is a unique name of a delayed source type classification rule. These are only considered as a last resort before generating a new source type based on the source seen. ... View more

then for extraction can i set CHECK_FOR_HEADER=TRUE (for automating extraction header) then for extraction i have to write in props.conf only. actual file size is very bug and it conatin 25 fields with delimiter "|" ... View more

can u prove me some details?? it will be very helpful ... View more

http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime ... View more

thanks for ur information ... View more

For a search time manual field extraction with a regex. mysearch | rex "(? [^|])\|(? [^|] )\|(? [^|]*)" | table emp age place For an automatic field extraction, see http://docs.splunk.com/Documentation/Splunk/4.3.4/Data/Extractfieldsfromfileheadersatindextime on the search-head or indexer, define a search time field extraction for your sourcetype. in props.conf [mysourcetype] TRANSFORMS-mysourcetypefields = mysourcetypefieldsextraction in transforms.conf [mysourcetypefieldsextraction] FIELDS="emp", "age", "place" DELIMS="|" ... View more