Getting Data In

How to create a source type of file positional

rafamss
Contributor

Hi guys,

I have a file that contains blocks of data that are positionals, they have the size of fields Folloowing sample:

For the first field, the position could be the first byte with size of 3 positions and each fields following have a rule specific.

0083410001049703K ARQB4_B8E4_07 000000TESTENT 2513145609235200000000000000 CP000000000000WW

How to create a source type for this ?

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

When you tell Splunk to index the file, in inputs.conf (or in the GUI), give it a sourcetype name. Just choose a name that doesn't already exist and you will be fine ...

inputs.conf

[monitor:///path/to/mylogfile.log]
sourcetype = myNewSourcetype

Now you have a new sourcetype. To define the fields, you can use props.conf (and transforms.conf) quite easily.
For example, if the first field is 6 digits and the second field is 4 digits, you could do this

props.conf

[myNewSourcetype]
EXTRACT-mns1 = (?<Field1>\d{6})(?<Field2>\d{4})

You do need to know regular expressions, and you should probably also read

The docs Create and maintain field extractions...

This answer define custom fixed fields

View solution in original post

lguinn2
Legend

When you tell Splunk to index the file, in inputs.conf (or in the GUI), give it a sourcetype name. Just choose a name that doesn't already exist and you will be fine ...

inputs.conf

[monitor:///path/to/mylogfile.log]
sourcetype = myNewSourcetype

Now you have a new sourcetype. To define the fields, you can use props.conf (and transforms.conf) quite easily.
For example, if the first field is 6 digits and the second field is 4 digits, you could do this

props.conf

[myNewSourcetype]
EXTRACT-mns1 = (?<Field1>\d{6})(?<Field2>\d{4})

You do need to know regular expressions, and you should probably also read

The docs Create and maintain field extractions...

This answer define custom fixed fields

rafamss
Contributor

Hi Iguinn,

The problem was in the file. 😞

Thanks for your help.

0 Karma

rafamss
Contributor

Hi lguinn,

I have one problem, in my file has blank spaces and special characters. When I put the regex for extract the information that i need, it's not understanding this.

Do you know the which I need to do ? I tried use \D \d or just the dot for get the information, without success.

PS. I looked in the links above.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...