Extracted fields are not visible in the UI i.e. from pickfields

[sreedhardudi]

--input.conf

[monitor:///etl/issrdr/scripts/tst/splunk/input/updates.csv]
index=iss-rdr

--props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
CHECK_FOR_HEADER=TRUE

---updates.csv

TIME_STAMP,TRANSACTION_ID,ENTITY_NAME,ERROR_MESSAGE
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:07,000002137521,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:13:20,000002137522,INSTRUMENT_COMMENT,value too large for column 
2010-04-21 06:12:37,000002137520,INSTRUMENT_COMMENT,value too large for column 

[bwooden]

An alternate solution would be to modify your props.conf & transforms.conf to explicitly specify the headers

props.conf

[source::/etl/issrdr/scripts/tst/splunk/input/updates.csv]
REPORT-fields = updateFields

transforms.conf

[updateFields]
FIELDS="TIME_STAMP","TRANSACTION_ID","ENTITY_NAME","ERROR_MESSAGE"
DELIMS=","

[bwooden]

You shouldn't have had to re-start Splunk as those are search time field extractions. You might try a "| evaluate reload=T" but I don't think that is the challenge.

So you're seeing the results but when you choose "Pick Fields" those fields are not listed as options?

[sreedhardudi]

Not sure if any permissions setting is required to get this fields into the UI

[sreedhardudi]

I tried as suggested by you but still the fields are not displayed in the UI