How to configure props.conf and transforms.conf for index-time field extraction from a CSV file?

[egsub]

Hi,

We are trying the index-time field extraction for a specific case, and have no idea about the correct configuration.

Our CSV files contain headers with field names (not configured on forwarders), and we want to extract on index-time 2 fields out of 15.

csv example:
A,B,C,D,E
1,2,3,4,5
10,20,30,40,50
20,30,40,50,60
30,40,50,60,70
(we want to extract on index-time fields B,C)

What should we configure on props.conf and transforms,conf on indexers?

[woodcock]

Do you really need to do just those 2? The investment involved to do any is nearly identical to the investment involved to do all of them which you can do like this:

INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER = ","
HEADER_FIELD_DELIMITER = ","
HEADER_FIELD_LINE_NUMBER = 1
TIMESTAMP_FIELDS = 1

Make sure you adjust the TIMESTAMP_FIELDS line (I guessed) and then put this on all of your indexers.

[egsub]

Hi,
Thanks for your reply.
we have already configured these pairs of configurations for timestamp recognition and field names identify.

We want to configure index-time field extraction and indexing in specific index-files for these fields - which configures in "FIELD_NAMES" in this stanza.

[woodcock]

The solution that I gave at first is done at index-time and if you do not like the names that the CSV file has in the header, you can override them with your preferred names by adding a configuration line like this to the original solution:

FIELD_NAMES = field1name, field2name, field3name, ...

See full details here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Extractfieldsfromfileheadersatindextime