Getting Data In

Wrong fields on receiver instance

Caio_Santos
Path Finder

One Splunk instance is forwarding data to a receiver, however the receiver is indexing the data and getting the wrong fields from another source.

So the forwarder has fields describing physical disk monitoring. The receiver has fields of logical disk monitoring of another instance, but before I forward this physical disk data I cleaned everything on my receiver index.

alt text

alt text

Thank you in advance!

0 Karma

Mick
Splunk Employee
Splunk Employee

Unfortunately the screenshots are too small for me to be able to make out exactly what is being displayed, but it sounds to me like you have some different extraction rules on your indexer than your forwarder.

For .csv files, Splunk can't recognize key-value pairs using the same logic that it does with other log types. It usually depends on the first line of the .csv file and extracts the field names from there. If the file your sending to the indexer, matches an already "learned" csv format, then Splunk will use the field names from that config.

If you take a look in $SPLUNK_HOME/etc/apps/learned/local/props.conf you'll see all of the 'learned' sourcetypes that Splunk has picked up since it started. Do any of the stanzas in there match up with what you're seeing in the fields list?

0 Karma

Caio_Santos
Path Finder

if you have a zoom with your brownser you might be able to better see the screenshots [i did it here before posting it and worked, but i'm sorry for this].
Mick probably what you are saying it's what happened, because before i attempt to forward this .csv file I indexed on the receiver another .csv file format. however, how i said i thought that cleaning the indexes would solve my problem but it didn't.

Here it's what i found in the receiver's props.conf:

[csv-2]
KV_MODE = none
REPORT-AutoHeader = AutoHeader-1
SHOULD_LINEMERGE = False
pulldown_type = true

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...