Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?

dw385 — Mon, 12 Jan 2015 14:44:34 GMT

I’m trying to pull a CSV file into Splunk with the fields extracted at index-time. My environment consist of multiple indexers with a master node, single search head, and a forwarder where the CSV file is at.
On the master and all the indexers is a props.conf:

[CSVData]
FIELD_NAMES = “Field1”,  “Field2”, “Field3”, “Field4”, “Field5”, “Field6”, “Field7”, “Field8”
FIELD_DELIMITER = ","
INDEXED_EXTRACTIONS = csv
CHECK_FOR_HEADER = false
KV_MODE = none
NO_BINARY_CHECK = false
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = TIMESTAMP
pulldown_type = true

On the forwarder I have an inputs.conf:

[batch://C:\CSV]
disabled = 0
move_policy = sinkhole
followTail = 0
index = csvindex
sourcetype = csvdata

The data is picked up and indexed. However when I search for the data in the index the fields are not extracted. All of the CSV data is just a ‘glob’ in the event. The props.conf above is an example of the CSV fields. The actual CSV has 34 columns in it, the props.conf includes all of them on my servers. Not all rows have data in each column.

The props.conf works when I try to input data manually from the web interface (time and fields are extracted properly) and this similar setup works in a single node test environment. I suspect I’m missing a piece to the configuration in the multi-node environment I’m in now.

Re: Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?

jayannah — Mon, 12 Jan 2015 15:04:36 GMT

By default, [source::] and [] stanzas match in a case-sensitive manner,
while [host::] stanzas match in a case-insensitive manner. This is a convenient default,
given that DNS names are case-insensitive.

Re: Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?

dw385 — Mon, 12 Jan 2015 15:34:36 GMT

Error on my part in trying to sanitize the post. The actual inputs.conf has sourcetype = CSVData, matching the props.conf.

topic Re: Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration? in Splunk Search

Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?

Re: Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?

Re: Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?