When I use the Splunk's Search & Reporting screen, it does not list any of the Interesting fields that are in the csv files it indexed.
I added a Hadoop Connect input and is configured as: Resource name: 192.168.56.102:9000/WeatherStationInfo/ White list regex: *.txt Set the source type: Manual Source type: weatherInfo Host field value: splunk Index: weather
/opt/splunk/etc/system/local/props.conf contains: [weatherInfo] INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TIME_FORMAT = %Y-%m-%d %H:%M:%S pulldown_type = 1
One of the files Splunk indexed was: Time,TemperatureF,DewpointF,PressureIn,WindDirection,WindDirectionDegrees,WindSpeedMPH,WindSpeedGustMPH,Humidity,HourlyPrecipIn,Conditions,Clouds,dailyrainin,SolarRadiationWatts/m^2,SoftwareType,DateUTC 2014-01-01 00:00:00,45.2,24.4,30.16,ENE,71,1.0,4.0,44,0.00,,,0.00,0.0,WUHU216DAVISVP2,2014-01-01 08:00:00, 2014-01-01 00:05:00,45.3,24.0,30.16,ENE,65,2.0,4.0,43,0.00,,,0.00,0.0,WUHU216DAVISVP2,2014-01-01 08:05:00, 2014-01-01 00:10:00,45.6,24.2,30.16,ENE,65,2.0,4.0,43,0.00,,,0.00,0.0,WUHU216DAVISVP2,2014-01-01 08:10:00, ...
The fields listed on the first line, such as TemperatureF, are not listed as one of the Interesting fields and I cannot use them to search. Where am I doing wrong?
Thanks, Bill.