Splunk Search

Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?

dw385
Explorer

I’m trying to pull a CSV file into Splunk with the fields extracted at index-time. My environment consist of multiple indexers with a master node, single search head, and a forwarder where the CSV file is at.
On the master and all the indexers is a props.conf:

[CSVData]
FIELD_NAMES = “Field1”,  “Field2”, “Field3”, “Field4”, “Field5”, “Field6”, “Field7”, “Field8”
FIELD_DELIMITER = ","
INDEXED_EXTRACTIONS = csv
CHECK_FOR_HEADER = false
KV_MODE = none
NO_BINARY_CHECK = false
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = TIMESTAMP
pulldown_type = true

On the forwarder I have an inputs.conf:

[batch://C:\CSV]
disabled = 0
move_policy = sinkhole
followTail = 0
index = csvindex
sourcetype = csvdata

The data is picked up and indexed. However when I search for the data in the index the fields are not extracted. All of the CSV data is just a ‘glob’ in the event. The props.conf above is an example of the CSV fields. The actual CSV has 34 columns in it, the props.conf includes all of them on my servers. Not all rows have data in each column.

The props.conf works when I try to input data manually from the web interface (time and fields are extracted properly) and this similar setup works in a single node test environment. I suspect I’m missing a piece to the configuration in the multi-node environment I’m in now.

0 Karma

dw385
Explorer

Error on my part in trying to sanitize the post. The actual inputs.conf has sourcetype = CSVData, matching the props.conf.

0 Karma

jayannah
Builder

By default, [source::] and [] stanzas match in a case-sensitive manner,
while [host::] stanzas match in a case-insensitive manner. This is a convenient default,
given that DNS names are case-insensitive.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...