AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability?

ehudb — Thu, 01 Dec 2022 16:23:29 GMT

We have a new Splunk Cloud environment

We are using AWS TA Add On to ingest files from S3

The files have extension of ".csv" but they are not really CSV, they are TSV (tab separated values).

The Add-On has built-in functionality to inspect CSV files and tried to convert them to json, therefore it fails to ingest them correctly.

Is there any way to turn-off the CSV parsing ability of the S3 input?

Re: AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability?

mmwilson0 — Wed, 21 Dec 2022 23:13:31 GMT

Try adding to your input:

parse_csv_with_header=0