View event data
This topic describes the initial steps of using data preview in Splunk Enterprise. If you want to learn how to adjust the results, read the "Modify event processing" topic.
You access data preview automatically when you start to create a file input in Splunk Web. When you start to add a new input from the Files & Directories page in Splunk Web, as described here, Splunk Web first presents you with the option to preview a file. At that point, you can give it a file to preview or you can skip data preview and continue directly to the Files & Directories input page.
Specify the file to preview
When you enter from Files & Directories, Splunk Web presents you with a dialog where you can select a file to preview:
1. Select the radio button, Preview data before indexing.
2. Enter the filename in the Path to file field. The file needs to be local to the Splunk Enterprise server.
Note: Alternatively, you can click the Browse server button to locate the desired file by browsing through a directory tree view interface.
3. Select the Continue button.
Splunk Web takes you to the source type selection dialog.
Note: If you don't want to preview your data, select the radio button, Skip: don't preview.
Select the source type
After you give data preview the name of a file, it presents you with a dialog where you can designate the method for selecting a source type for the file. The choices are:
- Use auto-detected source type. In most cases, Splunk Enterprise makes a reasonable guess as to which source type should be applied to the data. The dialog indicates what source type Splunk Enterprise has auto-detected, and you can choose whether to preview your data using that source type. If Splunk Enterprise cannot auto-detect the source type, it tells you and prompts you select from one of the two remaining options.
- Start a new source type. You can create a new source type from scratch.
- Apply an existing source type. You can select a predefined source type from the dropdown list.
Make your selection and click Continue. Splunk Web takes you to the main Data Preview page, where you can view the results of applying the source type and make any necessary changes to the source type.
Prepare your data
The data preview window
This documentation applies to the following versions of Splunk® Enterprise: 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14