Splunk Search

Why am I unable to extract all fields from a CSV log in Splunk 6.2.5?

dcascione
Explorer

I'm trying to extract fields from a basic .csv log with no luck.

Here is the file how it looks in Splunk 6.2.5..
alt text

When I try to configure a field extraction, Splunk only recognizes the very first instance....
alt text

Any help would be greatly appreciated - thanks!

0 Karma

woodcock
Esteemed Legend

In props.conf you need KV_MODE=multi
- Used for search-time field extractions only.
- Specifies the field/value extraction mode for the data.

0 Karma

cpraznowski_spl
Splunk Employee
Splunk Employee

The data is being loaded into a single event.

Should it break thusly?
3/29/2016,APC-DEV,-,0,0,0,0
3/29/2016,MPC-TEMP,0,3,03

If that's so, please let me know...

0 Karma

dcascione
Explorer

Yes, This is how I would like to see the log file break....

0 Karma

cpraznowski_spl
Splunk Employee
Splunk Employee

got it....that's the problem, need to break after the carriage return.

1) When you ingest the file, you need to create a new custom sourcetype.
2) in $splunk/etc/apps/search/local .... you'll see that new sourcetype referenced.
3) you need to instruct splunk to break after each line: LINE_BREAKER = ([\r\n]+)

...or the props.conf on the deployment server should work as well....

http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Indexmulti-lineevents

0 Karma

woodcock
Esteemed Legend

I assume you are using rex so you need to use the max_match=0 option.

0 Karma

dcascione
Explorer

Should this option be added to the props.conf located here: /opt/splunk/etc/deployment-apps/app_common/local ?

0 Karma

woodcock
Esteemed Legend

You did not mention props.conf in your question so we had to guess. That is why it is important to clearly spell out what you have done so far. No, max_match is not part of the props.conf way of extracting fields. I will post another answer.

0 Karma

cpraznowski_spl
Splunk Employee
Splunk Employee

When you go to production yes, tthe props.conf will then get sent to the forwarder that is collecting the data.

But for now you can test in : in $splunk/etc/apps/search/local .. and local the file a local directory to test...does that make sense?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...