Archive

fields not showing up from csv source with header in first line.

New Member

Hi,

I have a csv file which grows every five min. it's proper header fields. But I'm not getting the headers as fields. I checked All fields and also tried extracting using "Extract new fields". But still I can't see those fields.

my props.conf file is:
[custommqcsv]
SHOULDLINEMERGE=false
TIME
FORMAT=%Y-%m-%d:%T
HEADERFIELDLINENUMBER=0
INDEXED
EXTRACTIONS = csv

can you please help me how to get headers as fields. Note there is no spaces in headers and no quotes. all are properly comma separated.

Tags (1)
0 Karma

New Member

Hi,

Thank you. Tried the options. But no luck.

I even changed sourcetype to csv and mentioned FIELDNAMES explicitly. pushed this change to all forwarder and to search head cluster. But no luck. and one more issue is the source type still comes as custommq_csv instead of csv.

0 Karma

Motivator

Try to change the header field line to 1
And use the the FIELD_DELIMITER=, (replace , in case it's not ,)

------------
Hope I was able to help you. If so, an upvote would be appreciated.
0 Karma