Splunk Search

fields not showing up from csv source with header in first line.

anasar
New Member

Hi,

I have a csv file which grows every five min. it's proper header fields. But I'm not getting the headers as fields. I checked All fields and also tried extracting using "Extract new fields". But still I can't see those fields.

my props.conf file is:
[custom_mq_csv]
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%d:%T
HEADER_FIELD_LINE_NUMBER=0
INDEXED_EXTRACTIONS = csv

can you please help me how to get headers as fields. Note there is no spaces in headers and no quotes. all are properly comma separated.

Tags (1)
0 Karma

anasar
New Member

Hi,

Thank you. Tried the options. But no luck.

I even changed sourcetype to csv and mentioned FIELD_NAMES explicitly. pushed this change to all forwarder and to search head cluster. But no luck. and one more issue is the source type still comes as custom_mq_csv instead of csv.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Try to change the header field line to 1
And use the the FIELD_DELIMITER=, (replace , in case it's not ,)

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...