As it turns out, the issue (which is documented, but not anywhere obvious) is that the Field Names in my source type had spaces in them. This just fouls up the data model functions.
I ended up redefining my source to assign specific field names to it. The sourcetype was a custom type based on CSV which as far as I can tell should have removed spaces from the fields names but didn't. I doctored props.conf and used FIELD_NAMES to specify better field names for the columns and FIELD_HEADER_REGEX to ignore the old header record.
I should have been able to specify CLEAN_KEYS somehow but the exact usage escaped me (this time).
... View more