Quantcast
Channel: Questions in topic: "universal-forwarder"
Viewing all articles
Browse latest Browse all 1551

How to forward logs with Splunk Universal Forwarder for the files with no header and logs should be in form of key/value

$
0
0
I have a Splunk Forwarder setup already on my host. I have certain files on folder (/tom/mike/). File names are starting with Back*. The content of file may in one or multiple line. There are multiple fixed position values in each line with no header. Content (Example: Consider "-" as one space) Tom---516-----RTYUI------45678 Mik---345-----XYXFF------56789 I need splunk logs for each line. Like: Key1= Tom Key2=516 Key3= RTYUI Key4= 45678 Key1= Mike Key2= 345 Key3= XYXFF Key4= 56789 I know inputs.conf changes would be like below. [monitor:///tom/mike/Back*] index=myIndex blacklist=\.(gz|zip|bkz|arch|etc)$ sourcetype = BackFileData Please suggest changes which can be done in props.conf. Please keep in mind that delimiter is fixed for each value in line but its not same (like 2 spaces) for all column values. There are no headers as well in these files.

Viewing all articles
Browse latest Browse all 1551

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>