Hello!
So I am trying to ingest a CSV File. When at the preview screen prior to ingestion, all field names and columns line up and populate as expected. When I submit the data for ingestion, the fields aren't captured, and the data doesn't separate by comma. I have tried numerous different approaches: I attempted to manually set the field names in the transforms.conf, I eliminated the spaces in the field names, I've made a few modifications to the props.conf files, and so on. What am I missing?
Below is a snippet of the CSV:
IP Address,Device Name,MAC Address,Network Adapter Company,Device Information,User Text,First Detected On,Last Detected On,Detection Count,Active
10.0.0.203,EditedComputerName,0F-0F-0F-0F-0F-0F,Intel Corporate,,EditedComputerName,1/25/2018 8:25:22 PM,1/25/2018 9:00:40 PM,1,No
10.0.0.159,,0F-0F-0F-0F-0F-0F,SAMSUNG ELECTRO-MECHANICS(THAILAND),,,1/25/2018 2:13:32 AM,1/27/2018 1:12:35 PM,1,No
Here is my props.conf:
[MySourceType]
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
CHARSET = AUTO
INDEXED_EXTRACTIONS = csv
KV_MODE = none
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS = "Last Detected On"
EDIT: I have also tried the Splunk Field Extractor, and the result remains unchanged.
