My CSV headers are not extracting properly in splunk , Should be extracted into intresting feilds.What changes should i do to my props.conf

[guru865]

I see my csv log files headers showing as events and i would like have them in interesting fields extracted automatically.

CSV header ex: MMR,CLLL,city,Date,Time,Message,Status

props.conf
[XYZ]
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false
DATETIME_CONFIG = CURRENT

I have three diff source types where i need to apply similar conf to have the headers extracted .Please help and let me know if you need any further information.

[woodcock]

Try this in props.conf ON YOUR FORWARDER NODE and restart after deployment:

CSV header ex: MMR,CLLL,city,Date,Time,Message,Status

[XYZ]
INDEXED_EXTRACTIONS = CSV
TIMESTAMP_FIELDS = Date, Time
TIME_FORMAT = <Put Your Custom Stuff Here>

Note that only events forwarded AFTER the splunkd restart on the forwarder AFTER a correct configuration is deployed will have the field extractions present. Also be sure to set search mode to verbose.

[guru865]

Thanks Woodcock . I'm doing props.conf changes at indexer level as of now . I'll try it at forwarder node.

I've a question , does manual field extraction effect my CSV data in near feature . The user wants to have the fields extracted automatically not through manual extraction?

Appreciate your answers.

Thanks
guru.

[woodcock]

There are only 2 important "things" with fields: index-time vs. search-time. The former allows the use of tstats and other benefits for speed but takes up much more space. The rest of the decisions are mostly just packaging variations and don't really effect performance. By "manual" you are going the search-time route; you can easily repackage this to be automatic at search-time.

[guru865]

Would like to extract CSV headers as fields rather than doing manual field extraction