https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357445#M65272 <P>When specifying the sourcetype of the csv you are indexing, put cab because that one will automatically take care of that type of file.</P> <P>If you want to specify more things than the ones in the cab sourcetype, I would suggest you to copy the csv sourcetype and modify it the way you want.</P> <P>Let me know if the csv itself solved it</P> Fri, 16 Mar 2018 19:11:11 GMT tiagofbmm 2018-03-16T19:11:11Z https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357443#M65270 <P>When we index a csv file via the forwarder we see the following -</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4559i0182B16C4FE9AC23/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Why don't we see separate events?</P> Fri, 16 Mar 2018 19:02:11 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357443#M65270 ddrillic 2018-03-16T19:02:11Z https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357444#M65271 <P>Must be the end of line characters .. </P> Fri, 16 Mar 2018 19:08:59 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357444#M65271 ddrillic 2018-03-16T19:08:59Z https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357445#M65272 <P>When specifying the sourcetype of the csv you are indexing, put cab because that one will automatically take care of that type of file.</P> <P>If you want to specify more things than the ones in the cab sourcetype, I would suggest you to copy the csv sourcetype and modify it the way you want.</P> <P>Let me know if the csv itself solved it</P> Fri, 16 Mar 2018 19:11:11 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357445#M65272 tiagofbmm 2018-03-16T19:11:11Z https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357446#M65273 <P>I have a blackout when it comes to the sourcetypes and <STRONG>automatic</STRONG> detecting ; -) </P> Fri, 16 Mar 2018 19:40:04 GMT https://community.splunk.com/t5/Getting-Data-In/Indexing-a-csv-file-via-the-forwarder/m-p/357446#M65273 ddrillic 2018-03-16T19:40:04Z