Getting Data In

CSV Source not getting field headers.

JDukeSplunk
Builder

What am I doing wrong?
I am trying to get fields from a csv. I imported one csv file into a standalone Splunk server using the "add data" GUI. It picked up the header and displayed the fields perfectly. I then took the props.conf lines it generated and placed it on my indexer in /etc/system/local/props.conf. I then did a /debug/refresh on the indexer to reload the props.conf. When that didn't work I placed the props.conf alongside the inputs.conf on the forwarding host.. Neither worked.

When I ingest the data, there are no fields, just single line-by-lines.

alt text

My configs.

Inputs.conf

[monitor://E:\Health_Data_Fax_QA\Reporting\*(log$|txt$|csv$)]
disabled = 0
followTail = 0
sourcetype=hdfax:qa
ignoreOlderThan = 30d
index = application
crcSalt = 

[monitor://E:\Health_Data_Fax_UAT\Reporting\*(log$|txt$|csv$)]
disabled = 0
followTail = 0
sourcetype=hdfax:uat
ignoreOlderThan = 30d
index = application
crcSalt = 

props.conf

[hdfax:qa]
DATETIME_CONFIG = 
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true


[hdfax:uat]
DATETIME_CONFIG = 
INDEXED_EXTRACTIONS = csv
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
0 Karma
1 Solution

JDukeSplunk
Builder

The forwarder had to be upgraded to get the proper csv extractions. 6.5.2 did not do it, 7.2.3 did.

For complete info see this

https://answers.splunk.com/answers/739964/need-sedcmd-help.html

View solution in original post

0 Karma

JDukeSplunk
Builder

The forwarder had to be upgraded to get the proper csv extractions. 6.5.2 did not do it, 7.2.3 did.

For complete info see this

https://answers.splunk.com/answers/739964/need-sedcmd-help.html

0 Karma

skalliger
SplunkTrust
SplunkTrust

Your sample event has a different sourcetype than the ones listed in the props.

Is your standalone server a test server? Because later you're talking about moving the props.conf to the indexer.

Edit: Actually, it should be enough when you have the props.conf on your Universal Forwarder already and the config file should not be needed on your indexer.

Skalli

0 Karma

JDukeSplunk
Builder

Thanks for your input.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...