topic Re: My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf in Getting Data In

My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

guru865 — Tue, 29 Sep 2020 13:04:30 GMT

I see my csv log files headers showing as events and i would like have them in interesting fields extracted automatically.

CSV header ex: MMR,CLLL,city,Date,Time,Message,Status

props.conf
[XYZ]
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false
DATETIME_CONFIG = CURRENT

I have three diff source types where i need to apply similar conf to have the headers extracted .Please help and let me know if you need any further information.

Re: My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

guru865 — Wed, 01 Mar 2017 01:22:47 GMT

Would like to extract CSV headers as fields rather than doing manual field extraction

Re: My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

woodcock — Wed, 01 Mar 2017 02:11:13 GMT

Try this in props.conf ON YOUR FORWARDER NODE and restart after deployment:

CSV header ex: MMR,CLLL,city,Date,Time,Message,Status

[XYZ]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = Date, Time
TIME_FORMAT = <Put Your Custom Stuff Here>

Note that only events forwarded AFTER the splunkd restart on the forwarder AFTER a correct configuration is deployed will have the field extractions present. Also be sure to set search mode to verbose.

Re: My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

guru865 — Wed, 01 Mar 2017 16:18:06 GMT

Thanks Woodcock . I'm doing props.conf changes at indexer level as of now . I'll try it at forwarder node.

I've a question , does manual field extraction effect my CSV data in near feature . The user wants to have the fields extracted automatically not through manual extraction?

Appreciate your answers.

Thanks
guru.

Re: My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

woodcock — Wed, 01 Mar 2017 16:27:56 GMT

There are only 2 important "things" with fields: index-time vs. search-time. The former allows the use of tstats and other benefits for speed but takes up much more space. The rest of the decisions are mostly just packaging variations and don't really effect performance. By "manual" you are going the search-time route; you can easily repackage this to be automatic at search-time.