I have a props.conf file on a heavy forwarder:
[my:csv:report]
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
FIELD_DELIMITER = ,
HEADER_FIELD_QUOTE = "
FIELD_QUOTE = "
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = 1
Then I added a test file:
"Date","User","Domain","Activity","Result","Method","Host","IP","MAC","Endpoint Host","Endpoint IP","Endpoint MAC","Device Type"
"26 April 2021 00:00:29 EDT (GMT-0400)","username","example.org","Secondary Session","Successful","N/A","Hostname","10.11.22.33","00-11-22-33-44-55","N/A","N/A","N/A","N/A"
I am able to search the data very shortly with the sourcetype. The data is indexed, the header line is not in the search results. But no field extraction either!
Any hint is very much appreciated. I am running an indexer cluster. Everything is on Splunk Enterprise 7.3.4.
Thanks!
