Getting Data In

Problem of indexing data in indexer

sieutruc
Contributor

Hello ,

I get a problem of indexing data in indexer.
I have a file test.csv. When i monitored it locally in indexer with sourcetype substate ( configured in props.conf in indexer), indexer can parse data basing those fields inside props(ex:SHOULD_LINEMERGE=false)

But if i use Universal Forwarder (UF) to monitor that csv file,its entire data content is sent to indexer without using SHOULD_LINEMERGE=false above.

i know that at parsing time, we can configure in indexer, heavy forwarder, but impossible in UF.

So how can i configure to let Splunk indexer be able to index it correctly ?

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

Parse-time rules would still apply where the parsing is done. In environments where the forwarders are Universal Forwarders (UF), the parsing occurs on the indexer. Note that the inputs.conf on the UF may set a sourcetype--it is the rules for this sourcetype that would be applied at parse time.

0 Karma

ClementG
Path Finder

You have to do it on the Heavy Forwarder, you can set your stanza on either the sourcetype or the source of the file.

sieutruc
Contributor

In fact, my Splunk deployment is a bit more complicated. There is a intermediate forwarder(heavy forwarder) that will forward data from UF to indexer. I see 2 event from UF with the same sourcetype substate, but one seemed not to be applied sourcetype into.

So do i need to configure the same props in intermediate forwarder ?

0 Karma

ClementG
Path Finder

Hi,

You can add a props.conf on the indexer with a stanza on the specified sourcetype, source or host.

E.G.

[source::my.csv]
SHOULD_LINEMERGE = false

http://splunk-base.splunk.com/answers/48280/forwarder-configuration

Regards

Clement

0 Karma

sieutruc
Contributor

yes, i did, but it's not totally working

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...