Splunk Search

field is not getting extracted in splunk web interface

Tridi123
New Member

hi
my inputfile looks like
empid|name|age
356102|tutun|27
365771|king|28
i have configured props.conf file and transforms.conf in location C:\Program Files\Splunk\etc\system\local which is as below:

**props.conf**
[text] 
NO_BINARY_CHECK = 1 
KV_MODE=none 
SHOULD_LINEMERGE=false
REPORT-comment=Extract_text

**transforms.conf**
[Extract_text] 
DELIMS= "|"
FIELDS= "empid","name","age"

but after restarting splunk i am not getting the fields empid,name and age getting extracted in splunk web interface on left panel
can any one help on this becuase my requirement is to make log data in table format using table query in
web interface

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

I believe that your inputs.conf needs to reference a sourcetype. The sourcetype is the classification of your data.

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Whysourcetypesmatter

In props.conf you have a stanza with [text] therefore the sourcetype set for your input should have:

[default] 
host = 01HW447731
sourcetype=text

http://docs.splunk.com/Documentation/Splunk/5.0/admin/Propsconf

[]
* This stanza enables properties for a given .
* A props.conf file can contain multiple stanzas for any number of different .
* Follow this stanza name with any number of the following attribute/value pairs, as appropriate
for what you want to do.
* If you do not set an attribute for a given , the default is used.

can be:
1. , the source type of an event.
2. host::, where is the host for an event.
3. source::, where is the source for an event.
4. rule::, where is a unique name of a source type classification rule.
5. delayedrule::, where is a unique name of a delayed source type
classification rule.
These are only considered as a last resort before generating a new source type based on the
source seen.

0 Karma

Ayn
Legend

inputs.conf on the host you got this data from, please.

0 Karma

Tridi123
New Member

location for inputs.conf is C:\Program Files\Splunk\etc\system\local

0 Karma

Tridi123
New Member

inputs.conf looks like
[default]
host = 01HW447731

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Try putting a space between FIELDS so it looks like this:

FIELDS = "empid", "name", "age"

http://docs.splunk.com/Documentation/Splunk/5.0/admin/Transformsconf

0 Karma

Tridi123
New Member

location C:\Program Files\Splunk\etc\system\local
inputs.conf looks like
[default]
host = 01HW447731

do i need to change it??

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Can you add your inputs.conf settings to your original question as well.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...