What is the correct props.conf to ingest csv files?

[spl_aficionado]

@richgalloway explained clearly in the post, that INDEXED_EXTRACTIONS=CSV makes all the fields indexed. What would be a better way to ingest CSV files and avoid the fields from being indexed?

[livehybrid]

Hi @spl_aficionado 

If you dont want to index the CSV fields then you probably want to configure an EXTRACT in props.conf and exclude the INDEXED_EXTRACTIONS so it has no value.

# props.conf
[yourSourcetype]
#Update the regex as appropriate for your CSV file
EXTRACT-myCSVExtraction = (?<field1>[^,]+),(?<field2>[^,]+),(?<field3>[^,]+)

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing