Hi,
I'm trying to load a CSV file using the universal forwarder, and there are no headers in the CSV file. How can I give column names to those values in the file? Can I do that at props.conf? I don't want to use the extract field option...
eg : file.csv as below values
1,2,3,4,5
6,7,8,9,10
11,12,13,14,15
if you want to define the stanza by the source file name you can use:
[source::/path/to/file.csv]
FIELD_NAMES = A,B,C,D,E
@raghu0463 ,
You can configure them in props.conf
[your sourcetype for csv file]
FIELD_NAMES =field1,field2,.....
how does it identifies from which source and file ? if I just mention only csv
i.e
[csv]
FIELD_NAMES = A,B,C,D,E
@raghu0463 , thats what meant by [your sourcetype for csv file]
. You need to set a sourcetype for your file based on the content. Or you can use source/host in the SPEC
Common SPEC
[<spec>]
* This stanza enables properties for a given <spec>.
* A props.conf file can contain multiple stanzas for any number of
different <spec>.
* Follow this stanza name with any number of the following setting/value
pairs, as appropriate for what you want to do.
* If you do not set an setting for a given <spec>, the default is used.
<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
event.
3. source::<source>, where <source> is the source, or source-matching
pattern, for an event.