None of my configurations in props.conf is working and entire file is coming as single event
HEADER_FIELD_LINE_NUMBER = 1 is also not working
Data is server patching data
CHG0030338_Linux_Executive_Summary.log
Change_Request_Number$$@@$$Planned_Start_Date$$@@$$Planned_End_Date$$@@$$CR_Type$$@@$$Type$$@@$$Application$$@@$$Total_Servers$$@@$$Servers_Successfully_Patching$$@@$$Servers_Failed_Patching$$@@$$Servers_Skipped_Patching
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Total$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Rhel$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$CentOS$$@@$$0$$@@$$0$$@@$$0$$@@$$0$$@@$$0
CHG0030338$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$9/9/2020 5:45:00 PM (GMT)$$@@$$Linux$$@@$$Suse$$@@$$1$$@@$$1$$@@$$1$$@@$$0$$@@$$0
inputs.conf
[monitor:///opt/splunkforwarder/patch/*Summary*.log]
disabled = 0
index = patch_dummy
sourcetype = patch_summary
crcSalt = <SOURCE>
props.conf
[patch_summary]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
HEADER_FIELD_LINE_NUMBER = 1
TRANSFORMS-sourcetype = patch_sourcetype
TRANSFORMS-route = patch-monitoring-route
transforms.conf
[patch-monitoring-route]
REGEX = .
DEST_KEY =_TCP_ROUTING
FORMAT = acn-dev1-route-group
[patch_sourcetype]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::patch
Hi @ChetanArgekar,
Please try below in props.conf
[patch_summary]
DATETIME_CONFIG=CURRENT
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
HEADER_FIELD_LINE_NUMBER=1
FIELD_DELIMITER=$
Hi @ChetanArgekar,
Please try below in props.conf
[patch_summary]
DATETIME_CONFIG=CURRENT
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
HEADER_FIELD_LINE_NUMBER=1
FIELD_DELIMITER=$
It worked thanks for help