topic Re: CSV Extraction in Deployment Architecture

CSV Extraction

shugup2923 — Wed, 30 Sep 2020 10:29:37 GMT

I have a csv with data as below-

Timestamp	Total Capacity	Used Capacity	Available Capacity	Percentage Used
9/30/2020 11:11	209.34 TB	201.46 TB	7.88 TB	96.24%

my inputs.conf is -
[monitor://F:\Storage\Tools\CTW\MSA\MSA_FSutilization.csv]
sourcetype=csv_use_current_date
disabled=false
index=storage
crcSalt=<SOURCE>

props.conf -
[csv_use_current_date]
DATETIME_CONFIG = CURRENT
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

fields are not extracted properly, getting full data in single field-

Any Suggestion ??

Re: CSV Extraction

gcusello — Wed, 30 Sep 2020 10:46:07 GMT

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

Re: CSV Extraction

shugup2923 — Wed, 30 Sep 2020 11:01:38 GMT

My issue got resolved, issue was with field_delimiter , it was tab and I was missing that

Re: CSV Extraction

gcusello — Wed, 30 Sep 2020 11:58:28 GMT

Hi @shugup2923,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉