Getting Data In

File won't index

timmy13
Communicator

In testing for implementation on an enterprise Splunk implementation, I am working on my XP desktop with Splunk 4.31 installed.

I have a file that is essentially a csv file but is delimited by pipes (|). I want to use props.conf and transforms.conf to extract the fields. I have everything set up, I THINK correctly, but the file simple will not index. I am getting no data. Any help appreciated!

Here's the configs

inputs.conf....

[default]
host = MyPC

[monitor://C:\Documents and Settings\c5012044\My Documents\ebqa4\ebqa4a.pipe]
disabled = 0
followTail = 0
sourcetype = ebqa

props.conf...

[ebqa]
SHOULD_LINEMERGE = false
TRANSFORMS-t01 = csv1-fieldextraction
NO_BINARY_CHECK = 1
pulldown_type = 1

and transforms.conf...

[csv1-fieldextraction]
DELIMS="|"
FIELDS="TimeStamp","Start_Timestamp","Commit_Timestamp","Operation","Username","OS_Username", "Machine_Name", "SQL_Redo"

Thanks in advance for your help.

0 Karma

MarioM
Motivator
0 Karma

timmy13
Communicator

As I mentioned initially, this is on a test system. I have indexed exactly two files (or attempted to). This, and one other. Even on the Search App summary page, I seee only the other source, not this source. I am boggled.

0 Karma

MarioM
Motivator

this is strange...the only reason i could see is that the data is sent to an index which is NOT searched by default...
But as per your inputs.conf there is no specific index specified...
does 'index="*" sourcetype=ebqa' bring nothing too?

0 Karma

timmy13
Communicator

10 Records, no errors. I see the same info in the splunkd.log file. Mainly INFO events about parsing the file. 2 Warnings about timestamps being far apart, but accepted anyway.

0 Karma

MarioM
Motivator

what do you get from this search:

index=_internal sourcetype=splunkd "*.pipe"

Any errors?

0 Karma

timmy13
Communicator

Yes, I do
Says "Finished reading"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...