Why is my current configuration not extracting fields when indexing CSV files?

[khhenderson]

I need help indexing CSV files.
I have read this, http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Propsconf

My props.conf

[test_csv]
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER=,

My inputs.conf on the forwarder

[monitor:///pathtocsvfiles/*.csv]
index = test_index
sourcetype = test_csv
disabled = false

The first line of my CSV file defines the fields and they are comma delimited. Splunk is not using the first line as "interesting fields" once indexed.

Am I missing something?

[khhenderson · Accepted solution]

I got it worked out, I changed the sourcetype to "csv" in the inputs.conf and everything worked as expected. It's kind of a generic sourcetype but Splunk understands it.

[richgalloway]

Have you tried adding HEADER_FIELD_LINE_NUMBER = 1 to props.conf?

[khhenderson]

I will give it a shot.

[khhenderson]

same results, it didn't use the first line for the fields.

[richgalloway]

Can you post the first few lines from one of your CSVs?

[khhenderson]

For security reasons, I can't post more than the first line.
_id,category,createDate,target,subCategory,actionType,request.userAgent.raw,request.userAgent.browser.name,request.userAgent.browser.fullVersion,request.userAgent.browser.majorVersion,request.userAgent.os.name,request.userAgent.os.manufacturer,request.userAgent.os.type,request.remoteAddress,request.referrer,request.url,actionValues.assetGuid,actionValues.assetTitle,actionValues.assetTypeGuid,actionValues.conceptGuid,actionValues.entityType,actionValues.folderGuid,actionValues.folderTitle,actionValues.formatId,actionValues.isLocalHostUser,actionValues.layout,actionValues.mediaFileGuid,actionValues.mediaFileUrl,actionValues.playedFromLocalHost,actionValues.requestedLanguageId,actionValues.requestedReadingLevelId,actionValues.searchTerm,actionValues.unitGuid,user.siteGuid,user.role,user.isImpersonated,user.isPrivate,user.isStudent,user.userGuid,user.accountGuid,user.sessionId

[richgalloway]

Hmm... The _id field is suspicious. Field names with leading underscores tend to be reserved names. Can you change it?

[khhenderson]

I think I can, maybe put something in the transforms.conf file to change it.