fields not showing up from csv source with header in first line.

[anasar]

Hi,

I have a csv file which grows every five min. it's proper header fields. But I'm not getting the headers as fields. I checked All fields and also tried extracting using "Extract new fields". But still I can't see those fields.

my props.conf file is:
[custom_mq_csv]
SHOULD_LINEMERGE=false
TIME_FORMAT=%Y-%m-%d:%T
HEADER_FIELD_LINE_NUMBER=0
INDEXED_EXTRACTIONS = csv

can you please help me how to get headers as fields. Note there is no spaces in headers and no quotes. all are properly comma separated.

[anasar]

Hi,

Thank you. Tried the options. But no luck.

I even changed sourcetype to csv and mentioned FIELD_NAMES explicitly. pushed this change to all forwarder and to search head cluster. But no luck. and one more issue is the source type still comes as custom_mq_csv instead of csv.

[diogofgm]

Try to change the header field line to 1
And use the the FIELD_DELIMITER=, (replace , in case it's not ,)