Creating fields based on a comma seperated list of values

[sourabhguha]

Hi,

I am indexing a set of csv files. the files do not have the header fields in it.

While I am creating the sourcetype, I would like to specify the following fields name for the sourcetype - which is a comma separated list. How can i do that?

tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG,

[Ayn · Accepted solution]

Setup a delimiter based field extraction in props.conf / transforms.conf.

In props.conf, you put something like:

[yoursourcetype]
REPORT = getcsvfields

And in transforms.conf:

[getcsvfields]
DELIMS = ","
FIELDS = tenant,MGId,HostGroup,TotalVMsPerHG,TotalpCoreForHG,UsedpCoreForHG,FreepCoreForHG,CoreAvailabilityPercentForHG