Getting Data In

COnfiguration in props.conf not working

ChetanArgekar
Explorer

None of my configurations in props.conf is working and entire file is coming as single event

HEADER_FIELD_LINE_NUMBER = 1 is also not working

Data is server patching data

CHG0030338_Linux_Executive_Summary.log

Change_Request_Number$$@@$$Planned_Start_Date$$@@$$Planned_End_Date$$@@$$CR_Type$$@@$$Type$$@@$$Application$$@@$$Total_Servers$$@@$$Servers_Successfully_Patching$$@@$$Servers_Failed_Patching$$@@$$Servers_Skipped_Patching
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Total$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Rhel$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$CentOS$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Suse$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0

 

inputs.conf

[monitor:///opt/splunkforwarder/patch/*Summary*.log]
disabled = 0
index = patch_dummy
sourcetype = patch_summary
crcSalt = <SOURCE>

 

props.conf

[patch_summary]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
HEADER_FIELD_LINE_NUMBER = 1
TRANSFORMS-sourcetype = patch_sourcetype
TRANSFORMS-route = patch-monitoring-route

transforms.conf

[patch-monitoring-route]
REGEX = .
DEST_KEY =_TCP_ROUTING
FORMAT = acn-dev1-route-group

[patch_sourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::patch

 

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @ChetanArgekar,

Please try below in props.conf

[patch_summary]
DATETIME_CONFIG=CURRENT
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
HEADER_FIELD_LINE_NUMBER=1
FIELD_DELIMITER=$
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
Champion

Hi @ChetanArgekar,

Please try below in props.conf

[patch_summary]
DATETIME_CONFIG=CURRENT
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
HEADER_FIELD_LINE_NUMBER=1
FIELD_DELIMITER=$
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

ChetanArgekar
Explorer

It worked thanks for help

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!