Getting Data In

My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

guru865
Path Finder

I see my csv log files headers showing as events and i would like have them in interesting fields extracted automatically.

CSV header ex: MMR,CLLL,city,Date,Time,Message,Status

props.conf
[XYZ]
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false
DATETIME_CONFIG = CURRENT

I have three diff source types where i need to apply similar conf to have the headers extracted .Please help and let me know if you need any further information.

0 Karma

woodcock
Esteemed Legend

Try this in props.conf ON YOUR FORWARDER NODE and restart after deployment:

CSV header ex: MMR,CLLL,city,Date,Time,Message,Status

[XYZ]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = Date, Time
TIME_FORMAT = <Put Your Custom Stuff Here>

Note that only events forwarded AFTER the splunkd restart on the forwarder AFTER a correct configuration is deployed will have the field extractions present. Also be sure to set search mode to verbose.

0 Karma

guru865
Path Finder

Thanks Woodcock . I'm doing props.conf changes at indexer level as of now . I'll try it at forwarder node.

I've a question , does manual field extraction effect my CSV data in near feature . The user wants to have the fields extracted automatically not through manual extraction?

Appreciate your answers.

Thanks
guru.

0 Karma

woodcock
Esteemed Legend

There are only 2 important "things" with fields: index-time vs. search-time. The former allows the use of tstats and other benefits for speed but takes up much more space. The rest of the decisions are mostly just packaging variations and don't really effect performance. By "manual" you are going the search-time route; you can easily repackage this to be automatic at search-time.

0 Karma

guru865
Path Finder

Would like to extract CSV headers as fields rather than doing manual field extraction

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...