HEADER_FIELD_LINE_NUMBER = 1 not working

srinivasgowda — Fri, 12 Feb 2021 13:03:02 GMT

While trying to get the data from UF to indexer, the header is getting indexed as well. Attached the log file and the input.conf and props.conf configured currently

props.conf:

[linux_secure]
HEADER_FIELD_LINE_NUMBER = 1
FIELD_DELIMITER = ~^~
EVENT_BREAKER = "([\r\n]+)"

inputs.conf
[monitor:///tmp/Patch/*.log]
disabled = 0
index = main
sourcetype = linux_secure
crcSalt = <SOURCE>

log below:

Application~^~Server~^~Pre_Patching_Status~^~Patching_Status~^~Post_Patching_Status~^~Overall_Status
SAP GTS~^~sppgtslapew01~^~Success~^~Success~^~Success~^~Success
SAP GTS~^~sppgtslapew02~^~Success~^~Success~^~Success~^~Success
SAP GTS~^~sppgtsldbew01~^~Success~^~Failed~^~Skipped~^~Failed

Thank you.

Re: HEADER_FIELD_LINE_NUMBER = 1 not working

scelikok — Fri, 12 Feb 2021 14:08:06 GMT

Hi @srinivasgowda,

Can you please try with INDEXED_EXTRACTIONS=csv in props.conf?

topic Re: HEADER_FIELD_LINE_NUMBER = 1 not working in Getting Data In

HEADER_FIELD_LINE_NUMBER = 1 not working

Re: HEADER_FIELD_LINE_NUMBER = 1 not working