topic Re: inputcsv returning no results in Getting Data In

inputcsv returning no results

bruceclarke — Fri, 21 Jun 2013 14:50:04 GMT

All,

I am trying to read a csv file using the inputcsv command. I can't seem to figure out why, but the command isn't returning any results. The file (call it names.csv) is a list of names, like so:

Users
Bob Smith
Joe Somebody
John Doe

The file is located in var/run/splunk, as the documentation on inputcsv says it should. When I run the command

|inputcsv names.csv

I get no search results. Clicking the "Inspect..." link provides the following details:

This search has completed, but did not match any events. The terms specified in the highlighted portion of the search:None | inputcsv names.csv

"None" is the highlighted portion of the search, which makes me believe that it is not correctly parsing the inputcsv command as it should. I could, however, just be misinterpreting how the command should be used.

Any help you could provide would be greatly appreciated. Thanks!

Re: inputcsv returning no results

chris — Sun, 23 Jun 2013 11:14:27 GMT

Hmm, this should work ... I just tried the same on an a Splunk instance i have acces to. I tried with different user roles admin,power,user all worked. Do you have a distributed environment (Seperate servers for search head & indexers)? Then you should create the file on the search head. Oh and by var/run/splunk you mean $SPLUNK_HOME/var/run/splunk right? Oh and the splunk process does have access to the file names.csv. You're probably good an all those basic things, just trying to help you pin down the problem.

Re: inputcsv returning no results

bruceclarke — Sun, 23 Jun 2013 20:29:54 GMT

Thanks for the comment. I'm working on a distributed environment, but I do have the file on the search head. I have the file in the correct location ($SPLUNK_HOME/var/run/splunk), and splunk should have access to it (I actually restricted access to it once and got an error message saying Splunk couldn't read the contents).

I'm a little curious as to why the search highlights "None" which comes before the inputcsv command. It almost seems to suggest that it's looking for something before the csv command, but not finding it. Could you shed any light on that?

Re: inputcsv returning no results

bruceclarke — Sun, 23 Jun 2013 21:26:21 GMT

Ah, I figured it out. The line endings were in Unix format, which must have been throwing the command off. Once I switched them to Windows format, it worked.

Re: inputcsv returning no results

chris — Mon, 24 Jun 2013 13:17:19 GMT

Glad you found the answer to the issue, I didn't think of that.

Re: inputcsv returning no results

pallavibalasa — Mon, 29 Aug 2016 07:32:09 GMT

I am stuck with similar issue. It throws error saying file could not be read. I created the file and placed it in specified directory splunk/var/run/splunk/csv/...
I use command inputcsv filename.csv...
File is not read and no results returned.
Please help.

File looks like this......
InvApprover,Status
pallavi ,approved

Re: inputcsv returning no results

bruceclarke — Mon, 29 Aug 2016 13:21:51 GMT

@pallavibalasa - It looks like the accepted answer here does not apply to your problem. I was always able to see the file, which is not the case for you. I would suggest creating a new Splunk Answer post to address that, rather than commenting on a 3+ year old post that people might not see.