Getting Data In

Index time csv monitor

sean193
Explorer

Hey All,

Having issues getting data in.  With the inputs monitor stanza only data comes thru but when I add the props to do indexed time field extractions data stops coming all together.  No errors are seen in _internal, anyone got some ideas? 

Inputs.conf
[monitor://C:\file\data\]
whitelist = file1.csv$
index = file1
sourcetype = file1
disabled = false

Props.conf
[file1]
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMETER=,
FIELD_QUOTE="
HEADER_FIELD_DELIMETER=,

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!