Hi,
I have a csv file which grows every five min. it's proper header fields. But I'm not getting the headers as fields. I checked All fields and also tried extracting using "Extract new fields". But still I can't see those fields.
my props.conf file is:
[custom_mq_csv]
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%d:%T
HEADER_FIELD_LINE_NUMBER=0
INDEXED_EXTRACTIONS = csv
can you please help me how to get headers as fields. Note there is no spaces in headers and no quotes. all are properly comma separated.
Hi,
Thank you. Tried the options. But no luck.
I even changed sourcetype to csv and mentioned FIELD_NAMES explicitly. pushed this change to all forwarder and to search head cluster. But no luck. and one more issue is the source type still comes as custom_mq_csv instead of csv.
Try to change the header field line to 1
And use the the FIELD_DELIMITER=, (replace , in case it's not ,)