Is there a way to handle csv format at search level?

[ddrillic]

Is there a way to handle csv files without using INDEXED_EXTRACTIONS = csv at all? As a rule of thumb, we defer field discovery to the search heads. So, is there a way to do it for the csv format as well?

[martin_mueller · Accepted solution]

Ignoring the obvious question (Why?), you can set up transforms.conf with DELIMS and FIELDS to parse 1,2,3 into three named fields at search time on the indexers according to the search head's knowledge bundle.

[ddrillic]

Very kind @martin_mueller - thank you!

[ddrillic]

And from our Sales Engineer - CSVs are nice because they’re so simple. There are commas delimiting fields and a field header.

Example config - Extract fields from files with structured data