Thx. [retail-device-app-analytics] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://sra-event/retailDevice/prod/appAnalytics/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://sra-event/retailDevice/prod/appAnalytics/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://sra-event/retailDevice/prod/appAnalytics/... vix.provider = sra-rms [retail-device-app-compliance] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://sra-event/retailDevice/prod/appCompliance/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://sra-event/retailDevice/prod/appCompliance/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://sra-event/retailDevice/prod/appCompliance/... vix.provider = sra-rms [provider:sra-rms] vix.command.arg.3 = $SPLUNK_HOME/bin/jars/SplunkMR-s6.0-hy2.0.jar vix.env.HADOOP_HOME = /opt/hadoop/apache/hadoop-2.4.0 vix.env.JAVA_HOME = /opt/java/latest/ vix.family = hadoop vix.fs.default.name = hdfs://ip-172-31-35-19.us-west-2.compute.internal:9000 vix.mapreduce.framework.name = yarn vix.mapreduce.jobhistory.address = ip-172-31-35-19.us-west-2.compute.internal:10020 vix.splunk.emr.cluster.ami.version = 3.9.0 vix.splunk.emr.cluster.date.creation = 1443709072 vix.splunk.emr.cluster.date.ready = 1443709335 vix.splunk.emr.cluster.hadoop.version = 2.4.0 vix.splunk.emr.cluster.id = j-KQADNCLW7WD vix.splunk.emr.cluster.instance.group.core.id = ig-2SVVB6HXIEZEY vix.splunk.emr.cluster.instance.group.core.instance.type = c3.8xlarge vix.splunk.emr.cluster.instance.group.core.size = 1 vix.splunk.emr.cluster.instance.group.master.id = ig-1JPD70MV0UIKJ vix.splunk.emr.cluster.instance.group.master.instance.type = m3.xlarge vix.splunk.emr.cluster.instance.group.master.size = 1 vix.splunk.emr.cluster.master.external = ec2-52-89-25-131.us-west-2.compute.amazonaws.com vix.splunk.emr.cluster.master.internal = ip-172-31-35-19.us-west-2.compute.internal vix.splunk.emr.cluster.name = sra-rms vix.splunk.emr.cluster.region = us-west-2 vix.splunk.emr.cluster.state = WAITING vix.splunk.home.hdfs = /user/hunk/working-dir/ vix.yarn.resourcemanager.address = ip-172-31-35-19.us-west-2.compute.internal:9022 vix.yarn.resourcemanager.scheduler.address = ip-172-31-35-19.us-west-2.compute.internal:9024 vix.splunk.emr.cluster.latest.connection.check = 1446475334 vix.splunk.emr.cluster.latest.connection.success = 1446475334 vix.splunk.emr.cluster.instance.group.task.id = ig-QE7JS0IWGLQZ vix.splunk.emr.cluster.instance.group.task.instance.type = m3.2xlarge vix.splunk.emr.cluster.instance.group.task.size = 7 [preprod-retail-device-app-analytics] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalytics/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalytics/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/appAnalytics/... vix.provider = sra-rms vix.input.1.et.offset = 0 [preprod-retail-device-app-compliance] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/appCompliance/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/appCompliance/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/appCompliance/... vix.provider = sra-rms [retail-device-app-analytics-session] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://sra-event/retailDevice/prod/appAnalyticsSession/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://sra-event/retailDevice/prod/appAnalyticsSession/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://sra-event/retailDevice/prod/appAnalyticsSession/... vix.provider = sra-rms [retail-device-app-analytics-application] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://sra-event/retailDevice/prod/appAnalyticsApplication/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://sra-event/retailDevice/prod/appAnalyticsApplication/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://sra-event/retailDevice/prod/appAnalyticsApplication/... vix.provider = sra-rms [preprod-retail-device-app-analytics-application] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsApplication/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsApplication/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsApplication/... vix.provider = sra-rms [preprod-retail-device-app-analytics-session] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsSession/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsSession/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsSession/... vix.provider = sra-rms [preprod-rcs-api-request] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/prod/consolidated/apiRequest/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/prod/consolidated/apiRequest/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/prod/consolidated/apiRequest/... vix.provider = sra-rms [preprod-consumer-device-response-report-analytics-20-collected-info] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-consumer-event/cep/prod/consolidated/responseReportAnalytics20CollectedInfo/event_date=(\d+)-(\d+)-(\d+) / vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-consumer-event/cep/prod/consolidated/responseReportAnalytics20CollectedInfo/event_date=(\d+)-(\d+)-(\d+) / vix.input.1.path = s3n://rcs-consumer-event/cep/prod/consolidated/responseReportAnalytics20CollectedInfo/... vix.provider = sra-rms [preprod-consumer-device-response-report-analytics-20-event-info] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/responseReportAnalytics20EventInfo/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/responseReportAnalytics20EventInfo/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/responseReportAnalytics20EventInfo/... vix.provider = sra-rms [preprod-consumer-device-request-reactivation] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/requestReactivation/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/requestReactivation/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/requestReactivation/... vix.provider = sra-rms [preprod-retail-device-app-analytics-screen] vix.input.1.et.format = yyyyMMdd vix.input.1.et.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsApplicationScreen/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.lt.format = yyyyMMdd vix.input.1.lt.offset = 86400 vix.input.1.lt.regex = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsApplicationScreen/event_date=(\d+)-(\d+)-(\d+)/ vix.input.1.path = s3n://rcs-cms-event/cep/prod/consolidated/appAnalyticsApplicationScreen/... vix.provider = sra-rms ... View more

Hi I'm using Splunk and Hunk on AWS. We have a Hive external table with textfile format. It's field delimiter is comma. I'm able to setup a index provider and virtual index for the hive table with the following setup. However, the field values are not parsed properly. It seems Splunk put the entire row to the 1st field. Is there a vix.input.1.hive.??? parameter for hive field delimiter? vix.input.1.splitter.hive.columnnames=id,source,type,amount,status,from_pin,region_id,ip_address,date_closing,date_created,date_event,user_seller,account_seller,advertiser_id,user_id,account_id,sale_type,sale_item,sale_id,sale_amount,request,order_id,from_co,client_id,product_price,utcdate,bonus vix.input.1.splitter.hive.columntypes=string:string:string:double:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string:string vix.input.1.splitter.hive.dbname=rs_analytics vix.input.1.splitter.hive.tablename=transaction vix.input.1.splitter.hive.fileformat=textfile ... View more