I set up a splunk instance on a server with a local csv file that updates 1/min. Using the add data wizard, it auto detected all the appropriate timestamp, metadata and value fields. I then set splunk to forward to another instance (to test forwarding), and the data forwards fine, but its all in raw format. I looked for a props.conf file on the original server to see if the wizard created something I could copy over, but no luck.
Also, if you can help with setting this up on the reciever instance, can you also mention if there is a way to go through all the data that has already been indexed and extract the fields into the indexes?
Sorry, totally new to splunk, just trying to build a business case and do some DD before strapping to it as a platform!
asked 27 Feb '12, 08:14
Good news - field extraction is done at search time. This means that you can create fields for data that has already been indexed.
If you selected
Option 1 - Set sourcetype to csv
Here is one way to do this. This technique has you set the sourcetype of the input to
Important - this will only affect new data. It will not change the sourcetype of data that has already been indexed.
Option 2 - Set field extraction for a sourcetype
And here is another way. This technique assumes that the data has already been indexed, and has been assigned a sourcetype that is not
You may need to create the props.conf and transforms.conf files. Put them under
Now, as you add more data to splunk, you can continue to use sourcetype X and sourcetype Y, or create new sourcetypes as needed.
answered 27 Feb '12, 14:30