Hi,
I am trying to pull a data from a csv through deployment app but only the field names are getting indexed , data is not getting indexed. Number of records in csv is around 70000.
Tried through dbconnect but from there also same issue. Is there any limit of data which can be indexed at a time. If yes, where can that be verified?
Thanks
[monitor://C:\Program Files\SplunkUniversalForwarder\PSforSCCM\DailyDefenderReport\DailyDefenderReport.csv]
disabled = false
index = dbconnect
sourcetype = sccm:av_report:Workstations
crcSalt = <SOURCE>
Can you share your input stanza on input.conf please?
Regards
Ale
try to add on your input stanza this settings
INDEXED_EXTRACTIONS = csv
KV_MODE = none
try this if doesn't works I need a sample of your log.