|
Hello, Splunk is insisting on trying to auto-find headers in a tab-delimited CSV file for which I have manually defined headers in a CONF file. I thought that putting this information in /etc/system/local would override the /etc/apps/learned/ but it doesn't look like that's the case... Here are my CONF files for system-local: inputs.conf
props.conf
transforms.conf
* * * * * * * * * * * * * * ...and this all looks good, right? But... this is what the /system/learned/ CONF files populate as afterwards: * * * * * * * * * * * * * * props.conf
transforms.conf
Any ideas?? Thank you so much |
|
Solved: I capitulated. Don't fight the beast. I ended up saying screw-it, splunk, you can auto-extract field names for me. But I wrote a REGEX rule that pointed to nullQueue to remove the first line. See here: http://www.splunk.com/support/forum:SplunkAdministration/4081 |
|
You might want to add this to your props.conf http://www.splunk.com/base/Documentation/latest/admin/Propsconf LEARN_SOURCETYPE = [true|false]
Thanks, haven't got it to work yet, but I'll keep investigating. I think I might have to change some other things around relating to the source types.
(28 Apr '11, 12:44)
travispowell
Light bulb went off when I re-read your question. You will need to use DELIMS = "\t" for tab and not " "
(28 Apr '11, 12:59)
JSapienza
Thanks for the suggestions, but neither of those actually fixed it. The learn_sourcetype modifier did stop Splunk from trying to auto-define fields, but it didn't let my CONF files take over...
(28 Apr '11, 13:21)
travispowell
I think changes at this point would only apply to new event's and not events already indexed.
(28 Apr '11, 13:48)
JSapienza
This is a test box, because I have about 10+ GB /day of this stuff to index, (short halflife) and I'm cleaning the index every time. (> splunk clean eventdata) I got it to work with auto field extraction by inserting my own header line, but the issue there is that the header line is included in the count, and if I have 27,804 events I don't want it to say 27,805.
(28 Apr '11, 13:59)
travispowell
You would need to clean out the etc/apps/learned/props.conf file, and reindex the data.
(28 Apr '11, 19:48)
gkanapathy ♦
showing 5 of 6
show 1 more comments ▼
|