Hi there,
i tried to upload a csv-file. During Uploading I could separate the fields with a "comma" and the field name was displayed in the table (see screenshot 1).
Now I would like to search for the events with using the field names. But the field names are not extracted. Is there a possibility to extract the fields automatically with names that they can be used in the search? (see screenshot 2)
Thanks a lot for your help!
Yours Sina
Hi @wes7bb,
Can you please provide your props.conf configuration for sourcetype csv_AH
?
thanks for your help. Searching in the Verbose Mode was the solution.
Hi wes7bb,
Which search mode you are using? Search in verbose mode.