https://community.splunk.com/t5/Getting-Data-In/Populate-header-as-field-in-each-row-in-CSV-file/m-p/123527#M25497 <P>Hi,</P> <P>I want to index a csv file, the data looks like</P> <P>"ID","Name","hiredate"<BR /> "1","John","01-12-2014"<BR /> "2","Bob","01-12-2014"<BR /> "3","Mary","01-12-2014"</P> <P>When the data is indexed i want to see the data like:</P> <P>ID=1,Name=John,hiredate=01-12-2014<BR /> ID=2,Name=Bob,hiredate=01-12-2014<BR /> ID=3,Name=Mary,hiredate=01-12-2014</P> <P>Is there a way to this, currntly the data in index looks like</P> <P>1,John,01-12-2014</P> <P>2,Bob,01-12-2014</P> <P>3,Mary,01-12-2014</P> <P>Thanks</P> Thu, 23 Jan 2014 19:28:52 GMT surendrarhi 2014-01-23T19:28:52Z https://community.splunk.com/t5/Getting-Data-In/Populate-header-as-field-in-each-row-in-CSV-file/m-p/123527#M25497 <P>Hi,</P> <P>I want to index a csv file, the data looks like</P> <P>"ID","Name","hiredate"<BR /> "1","John","01-12-2014"<BR /> "2","Bob","01-12-2014"<BR /> "3","Mary","01-12-2014"</P> <P>When the data is indexed i want to see the data like:</P> <P>ID=1,Name=John,hiredate=01-12-2014<BR /> ID=2,Name=Bob,hiredate=01-12-2014<BR /> ID=3,Name=Mary,hiredate=01-12-2014</P> <P>Is there a way to this, currntly the data in index looks like</P> <P>1,John,01-12-2014</P> <P>2,Bob,01-12-2014</P> <P>3,Mary,01-12-2014</P> <P>Thanks</P> Thu, 23 Jan 2014 19:28:52 GMT https://community.splunk.com/t5/Getting-Data-In/Populate-header-as-field-in-each-row-in-CSV-file/m-p/123527#M25497 surendrarhi 2014-01-23T19:28:52Z https://community.splunk.com/t5/Getting-Data-In/Populate-header-as-field-in-each-row-in-CSV-file/m-p/123528#M25498 <P>No but I assume you want the "=" in the event to make search-time auto key-value extraction work. Use this instead:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime">http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime</A></P> <P>Put this in props.conf</P> <P><CODE>INDEXED_EXTRACTIONS=CSV</CODE></P> <P>Then in the Splunk Search field picker you will see:</P> <P><IMG src="http://answers.splunk.com//storage/Screen_Shot_2014-02-13_at_10.46.21_AM.png" alt="alt text" /></P> <P>And you can show the fields in the events if you want:</P> <P><IMG src="http://answers.splunk.com//storage/Screen_Shot_2014-02-13_at_10.48.02_AM.png" alt="alt text" /></P> Thu, 13 Feb 2014 15:48:41 GMT https://community.splunk.com/t5/Getting-Data-In/Populate-header-as-field-in-each-row-in-CSV-file/m-p/123528#M25498 ogdin 2014-02-13T15:48:41Z