Wrong fields on receiver instance

[Caio_Santos]

One Splunk instance is forwarding data to a receiver, however the receiver is indexing the data and getting the wrong fields from another source.

So the forwarder has fields describing physical disk monitoring. The receiver has fields of logical disk monitoring of another instance, but before I forward this physical disk data I cleaned everything on my receiver index.

Thank you in advance!

[Mick]

Unfortunately the screenshots are too small for me to be able to make out exactly what is being displayed, but it sounds to me like you have some different extraction rules on your indexer than your forwarder.

For .csv files, Splunk can't recognize key-value pairs using the same logic that it does with other log types. It usually depends on the first line of the .csv file and extracts the field names from there. If the file your sending to the indexer, matches an already "learned" csv format, then Splunk will use the field names from that config.

If you take a look in $SPLUNK_HOME/etc/apps/learned/local/props.conf you'll see all of the 'learned' sourcetypes that Splunk has picked up since it started. Do any of the stanzas in there match up with what you're seeing in the fields list?

[Caio_Santos]

if you have a zoom with your brownser you might be able to better see the screenshots [i did it here before posting it and worked, but i'm sorry for this].
Mick probably what you are saying it's what happened, because before i attempt to forward this .csv file I indexed on the receiver another .csv file format. however, how i said i thought that cleaning the indexes would solve my problem but it didn't.

Here it's what i found in the receiver's props.conf:

[csv-2]
KV_MODE = none
REPORT-AutoHeader = AutoHeader-1
SHOULD_LINEMERGE = False
pulldown_type = true