Getting Data In

props.conf for different csv files

lmjoin115
Explorer

hello ,

 

I am getting error "Ran out of data while looking for end of header" for csv files parsing , 

On UF , i have 

 

cat props.conf
[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
CHECK_FOR_HEADER = true
KV_MODE = none
category = Structured

 

 

cat inputs.conf
[monitor:///home/lalit/reports]
disabled = false
sourcetype = csv

 

I have done same props.conf on indexer 

Thanks

Lalit

Labels (3)
0 Karma

aasabatini
Motivator

Hi @lmjoin115 

the uf don't need the props conf file, if you need to parse data on collection layer you need a Heavyforwarder.

Anyway in your props is not present a timestamp field also add this line.

HEADER_FIELD_LINE_NUMBER=1

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...