https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126475#M26030 <P>I have a long running query (7 minutes or so) that I want to speed up, because I am doing variations of it over and over again. So I broke out the part that was common to all of them, and wrote it to a csv file. Then I tried to use that file as the source, and I get nothing. Event count is 0.</P> <P>If I had to venture a guess, I would suppose that it might have to do with newlines embedded in the _raw log entries. Can splunk properly parse a csv file if some of the strings in the file contain newlines?</P> <P>If the answer is yes, then does anybody have any other ideas what might cause a file just written with outputcsv to not be readable as an input source using inputcsv? </P> Tue, 03 Feb 2015 22:20:28 GMT jarrowwx 2015-02-03T22:20:28Z https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126475#M26030 <P>I have a long running query (7 minutes or so) that I want to speed up, because I am doing variations of it over and over again. So I broke out the part that was common to all of them, and wrote it to a csv file. Then I tried to use that file as the source, and I get nothing. Event count is 0.</P> <P>If I had to venture a guess, I would suppose that it might have to do with newlines embedded in the _raw log entries. Can splunk properly parse a csv file if some of the strings in the file contain newlines?</P> <P>If the answer is yes, then does anybody have any other ideas what might cause a file just written with outputcsv to not be readable as an input source using inputcsv? </P> Tue, 03 Feb 2015 22:20:28 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126475#M26030 jarrowwx 2015-02-03T22:20:28Z https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126476#M26031 <P>I always use outputlookup for things like this. Lately I've move on to tscollect and tstats. I use the netapp an VMware app and these commands are used to speed up perf queries.</P> <P>Not an answer to your problem, but another path to try if you need.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tscollect">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tscollect</A></P> Tue, 03 Feb 2015 23:51:56 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126476#M26031 thomrs 2015-02-03T23:51:56Z https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126477#M26032 <P>Unfortunately, I need more than time series data, I need the subset of records that I am searching over. The point is to do less work overall, skipping the processing of 2 million records that are established as irrelevant to my query. </P> Wed, 04 Feb 2015 18:30:58 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126477#M26032 jarrowwx 2015-02-04T18:30:58Z https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126478#M26033 <P>Depending on what you're actually trying to do, take a look at <CODE>|loadjob</CODE>: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/loadjob">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/loadjob</A></P> Thu, 05 Feb 2015 00:33:15 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-use-inputcsv-on-a-csv-file-just-created-with-outputcsv/m-p/126478#M26033 martin_mueller 2015-02-05T00:33:15Z