Splunk Search

Why are all events in one record and I am unable to extract fields?

godman01
Explorer

We have CSV files dropping in the Windows folder and the CSV file contains users data but it was not parsing correctly. it was showing all the events in one record which I am not able to extract the fields?
my data looks like:

"CN=xxxx\\\, xxxx\,OU=Users\,OU=Users and Groups\,DC=xxxxxx\,DC=net","xxxx","xxxxx","[ NormalAccount ]"
"CN=xxxxx\\\, xxxxx\,OU=Users\,OU=Users and Groups\,DC=xxxx\,DC=net","xxxxx","xxxxxx","[ NormalAccount ]"
"CN=xxxxx\\\, xxxxx\,OU=Users\,OU=Users and Groups\,DC=xxxxxxx\,DC=net",xxxxxx","xxxxxx","[ NormalAccount ]"

my inputs.conf:

[batch://F:\FTPROOT\Splunk Inputs]
move_policy = sinkhole
sourcetype = idm:ftp:ad
index = test
disabled = 0
crcSalt = 

[batch://F:\FTPROOT\Splunk Inputs\IDM*.csv]
move_policy = sinkhole
sourcetype = idm:ftp:idm
index = test
disabled = 0
crcSalt = 

and my props.conf:

[source::F:\FTPROOT\Splunk Inputs*]
CHECK_METHOD = modtime
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER=3
LINE_BREAKER = (uid=)(CN=)([\r\n]+)
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
INDEXED_EXTRACTIONS=csv

it should have different events individually. Any help will be appreciated?

0 Karma

lguinn2
Legend

I think the regular expression in your LINE_BREAKER is wrong.

If all your events are single-line (one event per line), then you can simply leave out the LINE_BREAKER; SHOULD_LINEMERGE=false is sufficient.

0 Karma

godman01
Explorer

Thanks for the reply but all my events are single line events but it is not showing as one event .All my events are showing as one record ?

0 Karma

godman01
Explorer

This data is alredy indexed so I want to make changes for the indexed data

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...