![alt text][1]
I'm trying to transform the current CSV file output we are getting from an APM into Splunk to graph response times. We have a forwarder set up to extract the CSV file data into Splunk. Currently, I am having an issue creating fields due to the poor CSV format with unnecessary data and numerous servers in one CSV. I am trying to key on the fields **mean** and **count**, and not concerned about any other fields. I've tried multiple suggestions to modify my props.conf file, with no luck.
I've attached an example of the CSVs, my inputs.conf, and props.conf. Any help would be greatly appreciated. I'm starting to fear the CSV format being passed from the APM is not workable. I've reviewed the current Splunk section at: http://docs.splunk.com/Documentation/Splunk/6.2.8/Data/Extractfieldsfromfileheadersatindextime
**props.conf**
[wily_reports]
#FIELD_HEADER_REGEX=Ignore_This_Stuff:\s(.*)
#FIELD_DELIMITER=,
FIELD_NAMES = "Mean" , "Count"
**inputs.conf**
[monitor://D:\ReportOutput\Client2_Weekly_Phil_Report.CSV]
disabled = false
host = Collector
index = wily
sourcetype = wily_reports
[1]: /storage/temp/106185-2-11-2016-11-28-20-am.jpg
↧