Getting Data In

props.conf for different csv files

lmjoin115
Explorer

hello ,

 

I am getting error "Ran out of data while looking for end of header" for csv files parsing , 

On UF , i have 

 

cat props.conf
[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
CHECK_FOR_HEADER = true
KV_MODE = none
category = Structured

 

 

cat inputs.conf
[monitor:///home/lalit/reports]
disabled = false
sourcetype = csv

 

I have done same props.conf on indexer 

Thanks

Lalit

Labels (3)
0 Karma

aasabatini
Motivator

Hi @lmjoin115 

the uf don't need the props conf file, if you need to parse data on collection layer you need a Heavyforwarder.

Anyway in your props is not present a timestamp field also add this line.

HEADER_FIELD_LINE_NUMBER=1

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...