Quantcast
Viewing all articles
Browse latest Browse all 1551

How to forward logs with Splunk Universal Forwarder for the files with no header and logs should be in form of key/value

I have a Splunk Forwarder setup already on my host. I have certain files on folder (/tom/mike/). File names are starting with Back*. The content of file may in one or multiple line. There are multiple fixed position values in each line with no header. Content (Example: Consider "-" as one space) Tom---516-----RTYUI------45678 Mik---345-----XYXFF------56789 I need splunk logs for each line. Like: Key1= Tom Key2=516 Key3= RTYUI Key4= 45678 Key1= Mike Key2= 345 Key3= XYXFF Key4= 56789 I know inputs.conf changes would be like below. [monitor:///tom/mike/Back*] index=myIndex blacklist=\.(gz|zip|bkz|arch|etc)$ sourcetype = BackFileData Please suggest changes which can be done in props.conf. Please keep in mind that delimiter is fixed for each value in line but its not same (like 2 spaces) for all column values. There are no headers as well in these files.

Viewing all articles
Browse latest Browse all 1551

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>