Indexing a csv file via the forwarder

[ddrillic]

When we index a csv file via the forwarder we see the following -

Why don't we see separate events?

[tiagofbmm · Accepted solution]

When specifying the sourcetype of the csv you are indexing, put cab because that one will automatically take care of that type of file.

If you want to specify more things than the ones in the cab sourcetype, I would suggest you to copy the csv sourcetype and modify it the way you want.

Let me know if the csv itself solved it

[ddrillic]

I have a blackout when it comes to the sourcetypes and automatic detecting ; -)

[ddrillic]

Must be the end of line characters ..