topic csv headers are not getting listed in Getting Data In

csv headers are not getting listed

Gowthamdevaraj — Fri, 17 Apr 2020 04:47:32 GMT

Hello,

I have clonned the CSV source type in Splunk and created a new CSV sourcetype as Alpha_csv and configured to monitor the csv files.

I have created a deployment apps and configured inputs.conf in deployment app.

All my csv files are not getting monitored but no as per header values. (no csv headers are getting listed)

csv sourcetype is set to auto, comma separated csv.

Can anyone help on this?

Thanks

Re: csv headers are not getting listed

PavelP — Fri, 17 Apr 2020 10:35:30 GMT

Hello @Gowthamdevaraj ,
if I understand you correctly the file get monitored correctly, but you cannot see the first line of the logs with header names? This is how indexed_extraction for CSV works - your fields are get parsed and mapped to the right field taken from the header line and the header line get removed. You can access any parsed field by using the field name.

Here is more info about indexed extraction: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Extractfieldsfromfileswithstructureddata

Have it worked before you cloned the source type?

Re: csv headers are not getting listed

manjunathmeti — Fri, 17 Apr 2020 13:04:50 GMT

Along with inputs.conf you also need to copy settings for Alpha_csv in props.conf in deployment app and deploy it to forwarder server.