Hi,
i have a csv feed with about 700 fields, and it looks like splunk is only auto-detecting about 100 one them. What's very strange is it seems to stop extracting them in the middle, but then the ones at the end get extracted.
For example, at the beginning, I have a number of fields - pkt_drop_percent, wire_mbits_per_sec.realtime, alerts_per_second... and then usr[0], idle[0], sys[0]... all the way up to usr[71], idle[71],sys[71]. It creates usr/idle/sys 0-24, but then skips from 25-71. But, then all the fields after usr[71],idle[71],sys[71] do get created. So, it's skipping from 25-71. Anyone ever run into this?
Here are my props settings from the HFW:
[sensor_info]
PREAMBLE_REGEX = ^#####################.*
ANNOTATE_PUNCT=false
MAX_TIMESTAMP_LOOKAHEAD = 35
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX=^
HEADER_FIELD_LINE_NUMBER = 2
FIELD_DELIMITER = ,
Finally, are these considered INDEXED_EXTRACTIONS?
