Splunk Search

Why are fields not extracted at index-time pulling a CSV file into Splunk with my current configuration?


I’m trying to pull a CSV file into Splunk with the fields extracted at index-time. My environment consist of multiple indexers with a master node, single search head, and a forwarder where the CSV file is at.
On the master and all the indexers is a props.conf:

FIELD_NAMES = “Field1”,  “Field2”, “Field3”, “Field4”, “Field5”, “Field6”, “Field7”, “Field8”
KV_MODE = none
pulldown_type = true

On the forwarder I have an inputs.conf:

disabled = 0
move_policy = sinkhole
followTail = 0
index = csvindex
sourcetype = csvdata

The data is picked up and indexed. However when I search for the data in the index the fields are not extracted. All of the CSV data is just a ‘glob’ in the event. The props.conf above is an example of the CSV fields. The actual CSV has 34 columns in it, the props.conf includes all of them on my servers. Not all rows have data in each column.

The props.conf works when I try to input data manually from the web interface (time and fields are extracted properly) and this similar setup works in a single node test environment. I suspect I’m missing a piece to the configuration in the multi-node environment I’m in now.

0 Karma


Error on my part in trying to sanitize the post. The actual inputs.conf has sourcetype = CSVData, matching the props.conf.

0 Karma


By default, [source::] and [] stanzas match in a case-sensitive manner,
while [host::] stanzas match in a case-insensitive manner. This is a convenient default,
given that DNS names are case-insensitive.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!