hello ,
I am getting error "Ran out of data while looking for end of header" for csv files parsing ,
On UF , i have
cat props.conf
[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
INDEXED_EXTRACTIONS = csv
CHECK_FOR_HEADER = true
KV_MODE = none
category = Structured
cat inputs.conf
[monitor:///home/lalit/reports]
disabled = false
sourcetype = csv
I have done same props.conf on indexer
Thanks
Lalit
Hi @lmjoin115
the uf don't need the props conf file, if you need to parse data on collection layer you need a Heavyforwarder.
Anyway in your props is not present a timestamp field also add this line.
HEADER_FIELD_LINE_NUMBER=1