Getting Data In

How to process a text file

TimothyPeh
Engager

Hi,

I have a test file which I want to process in Splunk. I'm able to load it into Splunk, but I'm trying to get Splunk to understand the fields and I'm stuck in what to do next.

For example:

Timestamp Event
1 10/14/13 10:43:35.000 AM

H20130326

2 10/14/13 10:43:35.000 AM

D HE12201303250329551124038092GTB27C02020402201303250337540000700000000000000

3 10/14/13 10:43:35.000 AM

D HE12201303250331431120034094GTB27C02020402201303250341580001000000000000000

4 10/14/13 10:43:35.000 AM

D HE12201303250349001050366450GTB27C02020402201303250350440000100000000000000

As you can see, my data is pretty much a long line of characters. In excel, I would use delimiter by field length to extract the data for excel to understand the file. Can I do the same thing with Splunk?

Much help is appreciated!

Thanks in advanced.

0 Karma

Lucas_K
Motivator

Have you tried using the Data input's data preview in the splunk web gui?

Click manager/data/data inputs/Add data.

It will allow you to play with the field extractions until its looking right.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...