--input.conf
[monitor:///etl/issrdr/scripts/tst/splunk/input/updates.csv]
index=iss-rdr
--props.conf
[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
CHECK_FOR_HEADER=TRUE
---updates.csv
TIME_STAMP,TRANSACTION_ID,ENTITY_NAME,ERROR_MESSAGE
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column
2010-04-21 06:13:07,000002137521,INSTRUMENT_COMMENT,value too large for column
2010-04-21 06:13:20,000002137522,INSTRUMENT_COMMENT,value too large for column
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column
An alternate solution would be to modify your props.conf & transforms.conf to explicitly specify the headers
props.conf
[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
REPORT-fields = updateFields
transforms.conf
[updateFields]
FIELDS="TIME_STAMP","TRANSACTION_ID","ENTITY_NAME","ERROR_MESSAGE"
DELIMS=","
You shouldn't have had to re-start Splunk as those are search time field extractions. You might try a "| evaluate reload=T" but I don't think that is the challenge.
So you're seeing the results but when you choose "Pick Fields" those fields are not listed as options?
Not sure if any permissions setting is required to get this fields into the UI
I tried as suggested by you but still the fields are not displayed in the UI