I'm trying to load a CSV file using the universal forwarder, and there are no headers in the CSV file. How can I give column names to those values in the file? Can I do that at props.conf? I don't want to use the extract field option...
@raghu0463 , thats what meant by [your sourcetype for csv file]. You need to set a sourcetype for your file based on the content. Or you can use source/host in the SPEC
* This stanza enables properties for a given <spec>.
* A props.conf file can contain multiple stanzas for any number of
* Follow this stanza name with any number of the following setting/value
pairs, as appropriate for what you want to do.
* If you do not set an setting for a given <spec>, the default is used.
<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
3. source::<source>, where <source> is the source, or source-matching
pattern, for an event.