Index only one column from csv input

[vinaykata]

I wanted to index only "Date" column from this CSV file. I don't want any of the other columns to be indexed and want to skip the first row before indexing. This is a continuous monitoring file. Is there any possible way to extract a single column from CSV input file?

[maciep]

I think you could add some parsing config on your indexer to handle this. First, you could call transforms to remove the header row (assuming that's the first row you don't want) and then SEDCMD to replace the first comma and the rest of the event with nothing.

Something like this maybe (tried match both of the non-data rows in sample for discard). This not tested so may but hopefully not too many typos..

props.conf

[your_sourcetype]
TIMESTAMP_FORMAT = %m/%d/%Y
SHOULD_LINEMERGE = false
TRANSFORMS-drop_header = drop_header
SEDCMD-keep_first_row = s/^([^,]+).+/\1/g

transforms.conf

[drop_header]
REGEX = ^(Date|Report)
DEST_KEY = queue
FORMAT = nullQueue