Splunk Search

Why is my Splunk forwarder not extracting CSV file fields?

606866581
Path Finder

Hi,

I've configured my forwarder's /etc/system/local/props.conf as such:

[mysourcetype]
INDEXED_EXTRACTIONS=CSV
FIELD_QUOTE="
FIELD_DELIMITER=,

outputs.conf is:

[default]
host = hostname23
[monitor:///qwerty/*]
index = myindex
disabled = false
followTail = 0
sourcetype = mysourcetype

And my indexer has its props.conf as:

[mysourcetype]
INDEXED_EXTRACTIONS=CSV
FIELD_QUOTE="
FIELD_DELIMITER=,

However, the events aren't being treated as CSVs, but rather, a generic log, so my headers have appeared as an actual event.

Any help is appreciated!

0 Karma
1 Solution

Jeremiah
Motivator

First, we'll assume you mean inputs.conf when you specified outputs.conf above. Also, your forwarder and indexer versions need to support indexed extractions (you didn't specify the versions you are running).

Have you tried it just without the FIELD_QUOTE and FIELD_DELIMITER settings? Both the values you have there are normal values for A CSV file. If you set the FIELD_* values you might then also have to set the same values for the HEADER_FIELD_QUOTE and HEADER_FIELD_DELIMITER.

You should also set SHOULD_LINEMERGE = False since these are single-line log entries and KV_MODE = none to disable automatic search time field extraction. The KV_MODE value should also go on your search head, or else you may see duplicate fields (both the index-time extracted field and the search time extracted fields).

View solution in original post

Jeremiah
Motivator

First, we'll assume you mean inputs.conf when you specified outputs.conf above. Also, your forwarder and indexer versions need to support indexed extractions (you didn't specify the versions you are running).

Have you tried it just without the FIELD_QUOTE and FIELD_DELIMITER settings? Both the values you have there are normal values for A CSV file. If you set the FIELD_* values you might then also have to set the same values for the HEADER_FIELD_QUOTE and HEADER_FIELD_DELIMITER.

You should also set SHOULD_LINEMERGE = False since these are single-line log entries and KV_MODE = none to disable automatic search time field extraction. The KV_MODE value should also go on your search head, or else you may see duplicate fields (both the index-time extracted field and the search time extracted fields).

606866581
Path Finder

The forwarder was running 4.2. Doh!
I've upgraded it and the problem is resolved. Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...