What am I doing wrong?
I am trying to get fields from a csv. I imported one csv file into a standalone Splunk server using the "add data" GUI. It picked up the header and displayed the fields perfectly. I then took the props.conf lines it generated and placed it on my indexer in /etc/system/local/props.conf. I then did a /debug/refresh on the indexer to reload the props.conf. When that didn't work I placed the props.conf alongside the inputs.conf on the forwarding host.. Neither worked.
When I ingest the data, there are no fields, just single line-by-lines.
My configs.
Inputs.conf
[monitor://E:\Health_Data_Fax_QA\Reporting\*(log$|txt$|csv$)]
disabled = 0
followTail = 0
sourcetype=hdfax:qa
ignoreOlderThan = 30d
index = application
crcSalt =
[monitor://E:\Health_Data_Fax_UAT\Reporting\*(log$|txt$|csv$)]
disabled = 0
followTail = 0
sourcetype=hdfax:uat
ignoreOlderThan = 30d
index = application
crcSalt =
props.conf
[hdfax:qa]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[hdfax:uat]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
The forwarder had to be upgraded to get the proper csv extractions. 6.5.2 did not do it, 7.2.3 did.
For complete info see this
https://answers.splunk.com/answers/739964/need-sedcmd-help.html
The forwarder had to be upgraded to get the proper csv extractions. 6.5.2 did not do it, 7.2.3 did.
For complete info see this
https://answers.splunk.com/answers/739964/need-sedcmd-help.html
Your sample event has a different sourcetype than the ones listed in the props.
Is your standalone server a test server? Because later you're talking about moving the props.conf to the indexer.
Edit: Actually, it should be enough when you have the props.conf on your Universal Forwarder already and the config file should not be needed on your indexer.
Skalli
Thanks for your input.