Splunk Search

Extract data from text file without Headers

shilpi
New Member

I have a text with values separated by spaces.This file does not have any headers. I need to add headers to this file and use this file in splunk. I can not manually do that as I will be getting a similar file every 15 minutes daily. Is there any way to do it using field extraction or something else in splunk?

Tags (2)
0 Karma

lukejadamec
Super Champion

The inputs.conf file needs to be on the forwarder that is monitoring the log directory. The props.conf and transforms.conf should be in the splunk\etc\system\local\ directory of the indexer. If those files don’t exist, then create them – make sure they have a .conf extension and not a .conf.txt extension.
You may need to further refine the configs, but if so you’ll need to provide more information.

inputs.conf

[monitor://blankpathtofiledirectory]
disabled = false
index = default
sourcetype = yourblanksourcetype

props.conf

[yourblanksourcetype]
SHOULD_LINEMERGE = false
TIME_FORMAT = blank
MAX_TIMESTAMP_LOOKAHEAD = blank
REPORT-spaced = spacedfields

transforms.conf

[spacedfields]
DELIMS = “ “
FIELDS =  list of comma separated fields

lukejadamec
Super Champion

So the person asking the question knows where information is missing.

0 Karma

kristian_kolb
Ultra Champion

why the explicit use of 'blank'?

/K

0 Karma

lukejadamec
Super Champion

Can you post the header, or some obfuscated reference header that you'll understand when we stick it in a configuration example?

0 Karma

shilpi
New Member

Yeah header will always be the same

0 Karma

shilpi
New Member

Also, please let me know if this can be done from splunk forwarders or do we need to go to splunk searchhead.Please let me know in case I need to do any changes from splunk UI as well

0 Karma

lukejadamec
Super Champion

Space separated files are easy to index if the files all have the same field composition.
If you could put a header in every file, would it always be the same header? If so, post it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...