Index only one column from csv input

vinaykata — Wed, 15 Nov 2017 20:06:36 GMT

I wanted to index only "Date" column from this CSV file. I don't want any of the other columns to be indexed and want to skip the first row before indexing. This is a continuous monitoring file. Is there any possible way to extract a single column from CSV input file?

Re: Index only one column from csv input

maciep — Wed, 15 Nov 2017 22:07:03 GMT

I think you could add some parsing config on your indexer to handle this. First, you could call transforms to remove the header row (assuming that's the first row you don't want) and then SEDCMD to replace the first comma and the rest of the event with nothing.

Something like this maybe (tried match both of the non-data rows in sample for discard). This not tested so may but hopefully not too many typos..

props.conf

[your_sourcetype]
TIMESTAMP_FORMAT = %m/%d/%Y
SHOULD_LINEMERGE = false
TRANSFORMS-drop_header = drop_header
SEDCMD-keep_first_row = s/^([^,]+).+/\1/g

transforms.conf

[drop_header]
REGEX = ^(Date|Report)
DEST_KEY = queue
FORMAT = nullQueue

topic Index only one column from csv input in Getting Data In

Index only one column from csv input

Re: Index only one column from csv input