topic Re: The header order changes in my monitored CSV file. Is there a way to have the forwarded data follow this order dynamically? in Getting Data In

The header order changes in my monitored CSV file. Is there a way to have the forwarded data follow this order dynamically?

riotto — Wed, 19 Oct 2016 14:41:27 GMT

I am monitoring a file that has comma separated values. For example: John, Smith, Maine

The data is being forwarded by a Universal Forwarder. I have the props.conf and transforms.conf set up to receive the data as: firstname, lastname, state

When I search in Splunk -- firstname=John, lastname=Smith, state=Maine

Here's the problem, the order of the data can change in the file, so my fields contain the wrong type of data. Is there a way to
to have the data follow its order dynamically? There is a header that is sent that tells me when the order changes.

Re: The header order changes in my monitored CSV file. Is there a way to have the forwarded data follow this order dynamically?

dmaislin_splunk — Tue, 29 Sep 2020 11:27:54 GMT

Check out indexed_extractions and leverage these new options to extract the structured data fields. NOTE: The indexed_extractions = CSV settings from props.conf are used on the FORWARDER. This method will always ensure that the fields are extracted correctly every time based on the header in the file.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Extractfieldsfromfileswithstructureddata

Re: The header order changes in my monitored CSV file. Is there a way to have the forwarded data follow this order dynamically?

riotto — Wed, 19 Oct 2016 15:59:56 GMT

doesn't the indexed_extractions do indexed time extraction, which I see in lots of documentation to avoid?