Getting Data In

Need to ingest structured data

csharm21
Loves-to-Learn

Hi Team,

I need to ingest the structure data but the file is not in csv format. however data inside it is structured. below is the log format which i want to index. can anyone help me with the instruction how we can do this.

#Fields: event,computer,operator,source,sourceid,executionid,starttime,endtime,datacode,databytes,message
PackageStart,pppep2413,MS\test,Spettl_tset,{43474344gfg94341B9-4186-gfC4-102E3fgfg0},{cgfgfg-bgfdf-4FFA-gggg-0C57996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,Beginning of package execution.
OnPreExecute,pppep2413,MS\test,Spettl_tset,{43474344E55-94341B9-4186-B5C4-C1fgfgfgfg0},{fgdfgdf-ggfgfD-gdf-A679-0C546CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
OnPreExecute,pppep2413,MS\test,Get Trigger ID,{4A50954F-137E-4CDD-A20F-fgfg},{fsdfgfgfsdf5-CedD-4FFA-A679-0436CC47996},2/17/2015 11:37:30 AM,2/17/2015 11:37:30 AM,0,0x,(null)
g
0 Karma

somesoni2
Revered Legend

See this. (even though file extension is not CSV, data is, so you'd need to create a custom sourcetype with field extraction configuration mentioned in below link)
https://docs.splunk.com/Documentation/SplunkCloud/7.2.4/Data/Extractfieldsfromfileswithstructureddat...

You may have to remove #Fields: from the data, so look for [ExtractCorrectHeaders] in above link.

0 Karma

csharm21
Loves-to-Learn

Thanks @somesoni2 I was following this document but still confused how to start. would it be possible for you to share one example for me to create props and input with above data to remove #Fields:

0 Karma

somesoni2
Revered Legend

Give this a try (on your forwarder)

[YourSourcetypeHere]
FIELD_HEADER_REGEX=\#Fields\:\s(.*)
FIELD_DELIMITER=,
TIMESTAMP_FIELDS = starttime
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...