Getting Data In

INDEXED_EXTRACTIONS=CSV not parsing?

ww9rivers
Communicator

I have a props.conf file on a heavy forwarder:

[my:csv:report]
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
FIELD_DELIMITER = ,
HEADER_FIELD_QUOTE = "
FIELD_QUOTE = "
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = 1

Then I added a test file: 

"Date","User","Domain","Activity","Result","Method","Host","IP","MAC","Endpoint Host","Endpoint IP","Endpoint MAC","Device Type"
"26 April 2021 00:00:29 EDT (GMT-0400)","username","example.org","Secondary Session","Successful","N/A","Hostname","10.11.22.33","00-11-22-33-44-55","N/A","N/A","N/A","N/A"

I am able to search the data very shortly with the sourcetype. The data is indexed, the header line is not in the search results. But no field extraction either!

Any hint is very much appreciated. I am running an indexer cluster. Everything is on Splunk Enterprise 7.3.4.

Thanks!

Labels (4)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.