Splunk Search

Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?


I’m trying to pull a CSV file into Splunk with the fields extracted at index-time. My environment consist of multiple indexers with a master node, single search head, and a forwarder where the CSV file is at.
On the master and all the indexers is a props.conf:

FIELD_NAMES = “Field1”,  “Field2”, “Field3”, “Field4”, “Field5”, “Field6”, “Field7”, “Field8”
KV_MODE = none
pulldown_type = true

On the forwarder I have an inputs.conf:

disabled = 0
move_policy = sinkhole
followTail = 0
index = csvindex
sourcetype = csvdata

The data is picked up and indexed. However when I search for the data in the index the fields are not extracted. All of the CSV data is just a ‘glob’ in the event. The props.conf above is an example of the CSV fields. The actual CSV has 34 columns in it, the props.conf includes all of them on my servers. Not all rows have data in each column.

The props.conf works when I try to input data manually from the web interface (time and fields are extracted properly) and this similar setup works in a single node test environment. I suspect I’m missing a piece to the configuration in the multi-node environment I’m in now.

0 Karma


Error on my part in trying to sanitize the post. The actual inputs.conf has sourcetype = CSVData, matching the props.conf.

0 Karma


By default, [source::] and [] stanzas match in a case-sensitive manner,
while [host::] stanzas match in a case-insensitive manner. This is a convenient default,
given that DNS names are case-insensitive.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...