Our production environment just upgraded to 6.2.5 from 6.0.3. The new data inputs seem to be pretty straight forward, except the index and sourcetype options are fairly limited. I will explain what I mean.
Data inputs in 6.0.x had the functionality to manually add a sourcetype. This was a nice feature because we have some props configurations out there to specifically parse the CSV file that I want to manually index for that sourcetype. For the index, I am unable to find it in the list. The only index names I can see are those that come "out of the box" (*index=main*, *index=os*, *index=Default*, etc. ). I also tried changing around the app context, however the list of indexes stays the same.
I am going in to Data Inputs-->Files & directories(local)-->New-->. From here I want to index a file once, and provide the directory and file name. Next, manually add a sourcetype that goes back to the props we have. It looks like most of the configurations needed should be done right in the UI instead?
As a work around, we can add an inputs.conf that monitors the local directory and tie it back to props.conf , but it would help to know how we could continue to manually add a csv with the correct index and manually add sourcetype if possible. If it helps, here are the configs I have tied to the data in the CSV:
*props.conf*
[oms_invoice]
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=15
DATETIME_CONFIG=/etc/apps/contract_props/default/oms_invoice_data_datetime.xml
SHOULD_LINEMERGE=false
EXTRACT-oms_invoice=(?[^,]*),\s*(?
↧