I have a csv file which grows every five min. it's proper header fields. But I'm not getting the headers as fields. I checked All fields and also tried extracting using "Extract new fields". But still I can't see those fields.
my props.conf file is:
INDEXEDEXTRACTIONS = csv
can you please help me how to get headers as fields. Note there is no spaces in headers and no quotes. all are properly comma separated.
I even changed sourcetype to csv and mentioned FIELDNAMES explicitly. pushed this change to all forwarder and to search head cluster. But no luck. and one more issue is the source type still comes as custommq_csv instead of csv.