Getting Data In

INDEXED_EXTRACTIONS=CSV not parsing?

ww9rivers
Contributor

I have a props.conf file on a heavy forwarder:

[my:csv:report]
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
FIELD_DELIMITER = ,
HEADER_FIELD_QUOTE = "
FIELD_QUOTE = "
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = 1

Then I added a test file: 

"Date","User","Domain","Activity","Result","Method","Host","IP","MAC","Endpoint Host","Endpoint IP","Endpoint MAC","Device Type"
"26 April 2021 00:00:29 EDT (GMT-0400)","username","example.org","Secondary Session","Successful","N/A","Hostname","10.11.22.33","00-11-22-33-44-55","N/A","N/A","N/A","N/A"

I am able to search the data very shortly with the sourcetype. The data is indexed, the header line is not in the search results. But no field extraction either!

Any hint is very much appreciated. I am running an indexer cluster. Everything is on Splunk Enterprise 7.3.4.

Thanks!

Labels (4)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...