topic Re: Is there a way to handle csv format at search level? in Getting Data In

Is there a way to handle csv format at search level?

ddrillic — Mon, 12 Nov 2018 15:59:55 GMT

Is there a way to handle csv files without using INDEXED_EXTRACTIONS = csv at all? As a rule of thumb, we defer field discovery to the search heads. So, is there a way to do it for the csv format as well?

Re: Is there a way to handle csv format at search level?

martin_mueller — Mon, 12 Nov 2018 17:28:40 GMT

Ignoring the obvious question (Why?), you can set up transforms.conf with DELIMS and FIELDS to parse 1,2,3 into three named fields at search time on the indexers according to the search head's knowledge bundle.

Re: Is there a way to handle csv format at search level?

ddrillic — Mon, 12 Nov 2018 18:08:22 GMT

Very kind @martin_mueller - thank you!

Re: Is there a way to handle csv format at search level?

ddrillic — Mon, 12 Nov 2018 18:12:53 GMT

And from our Sales Engineer - CSVs are nice because they’re so simple. There are commas delimiting fields and a field header.

Example config - Extract fields from files with structured data