I am going to be forwarding CSV and TSV files, and was wondering if I need to configure **both** INDEXED_EXTRACTIONS and FIELD_DELIMITER in props.conf for the sourcetype on the Universal Forwarder.
It seems redundant to tell it
INDEXED_EXTRACTIONS= csv **and** FIELD_DELIMITER= ,
and
INDEXED_EXTRACTIONS= tsv **and** FIELD_DELIMITER= \t
If it is a csv it should be obvious the field delimiter is a comma.
And if it is a tsv it should be obvious the field delimiter is a tab.
Is there a reason to configure both? Or if only one is needed is there a reason to use one over the other?
↧