CSV Source not getting field headers.

[JDukeSplunk]

What am I doing wrong?
I am trying to get fields from a csv. I imported one csv file into a standalone Splunk server using the "add data" GUI. It picked up the header and displayed the fields perfectly. I then took the props.conf lines it generated and placed it on my indexer in /etc/system/local/props.conf. I then did a /debug/refresh on the indexer to reload the props.conf. When that didn't work I placed the props.conf alongside the inputs.conf on the forwarding host.. Neither worked.

When I ingest the data, there are no fields, just single line-by-lines.

My configs.

Inputs.conf

[monitor://E:\Health_Data_Fax_QA\Reporting\*(log$|txt$|csv$)]
disabled = 0
followTail = 0
sourcetype=hdfax:qa
ignoreOlderThan = 30d
index = application
crcSalt = 

[monitor://E:\Health_Data_Fax_UAT\Reporting\*(log$|txt$|csv$)]
disabled = 0
followTail = 0
sourcetype=hdfax:uat
ignoreOlderThan = 30d
index = application
crcSalt = 

props.conf

[hdfax:qa]
DATETIME_CONFIG = 
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true


[hdfax:uat]
DATETIME_CONFIG = 
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true

[JDukeSplunk · Accepted solution]

The forwarder had to be upgraded to get the proper csv extractions. 6.5.2 did not do it, 7.2.3 did.

For complete info see this

https://answers.splunk.com/answers/739964/need-sedcmd-help.html

[skalliger]

Your sample event has a different sourcetype than the ones listed in the props.

Is your standalone server a test server? Because later you're talking about moving the props.conf to the indexer.

Edit: Actually, it should be enough when you have the props.conf on your Universal Forwarder already and the config file should not be needed on your indexer.

Skalli

[JDukeSplunk]

Thanks for your input.