Hi,
I've configured my forwarder's /etc/system/local/props.conf as such:
[mysourcetype]
INDEXED_EXTRACTIONS=CSV
FIELD_QUOTE="
FIELD_DELIMITER=,
outputs.conf is:
[default]
host = hostname23
[monitor:///qwerty/*]
index = myindex
disabled = false
followTail = 0
sourcetype = mysourcetype
And my indexer has its props.conf as:
[mysourcetype]
INDEXED_EXTRACTIONS=CSV
FIELD_QUOTE="
FIELD_DELIMITER=,
However, the events aren't being treated as CSVs, but rather, a generic log, so my headers have appeared as an actual event.
Any help is appreciated!
... View more