topic Re: headers in csv do not appear as field names in search result in Getting Data In

headers in csv do not appear as field names in search result

jackiewkc — Mon, 28 Sep 2020 18:22:56 GMT

Hi, I have a csv file which contains data like this:

"region","country","city"
"emea","united kingdom","london"
"emea","france","paris"
"apac","hong kong","hong kong"
"amer","usa","new york"

I believe my inputs.conf and props.conf are correct as I can see the data in splunk when I do a search "sourcetype=props_config". However, I don't see "region", "country" or "city" as the field names on the left in the Splunk GUI.

my inputs.conf is like:

[monitor:///data/logs/*/geo.csv]
host_segment = 3
index = testindex
sourcetype = props_config

my props.conf is like:

[props_config]
FIELD_DELIMITER = ,
HEADER_FIELD_DELIMITER = ,
FIELD_QUOTE = "

Any idea what is wrong here? Thanks.

Re: headers in csv do not appear as field names in search result

MuS — Tue, 16 Dec 2014 11:04:08 GMT

Hi jackiewkc,

not all fields are displayed by default in Splunk, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchTutorial/Aboutthesearchtabs#Events

To do a quick check for your fields do something like this:

your base search here  sourcetype=props_config| table region country city

hope this helps ...

cheers, MuS

Re: headers in csv do not appear as field names in search result

jackiewkc — Tue, 16 Dec 2014 11:11:41 GMT

Hi MuS,

Thanks for the quick reply. I was expecting to see these header fields when I selected "All Fields" but this is not the case.

I did the table thing you suggested and I can see the correct event counts.

Any idea how I can get the field names displayed?

Thanks.

Jackie

Re: headers in csv do not appear as field names in search result

MuS — Tue, 16 Dec 2014 11:22:33 GMT

Although it states all fields, it does not show all fields by default 😉 it only shows all field over a certain hit percentage ... I beleave it is something around 0.1% you can change it in the all fields 'window'

Re: headers in csv do not appear as field names in search result

jackiewkc — Tue, 16 Dec 2014 11:42:33 GMT

HI MuS,

The options I can see are:

All fields
coverage: 1% or more
coverage: 50% or more
coverage: 90% or more
coverage: 100%

And I have already selected "All fields...

Re: headers in csv do not appear as field names in search result

MuS — Tue, 16 Dec 2014 12:20:15 GMT

Did you set any filter for the fields?

Re: headers in csv do not appear as field names in search result

jackiewkc — Tue, 16 Dec 2014 12:26:01 GMT

No, I haven't set any filter....

Re: headers in csv do not appear as field names in search result

MuS — Tue, 16 Dec 2014 12:43:51 GMT

Only thing I can think of currently is the search mode...are you in fast, smart or verbose mode?

Re: headers in csv do not appear as field names in search result

jackiewkc — Tue, 16 Dec 2014 12:45:55 GMT

You are a genius !!! I was running in fast mode. It works after I changed it to smart.

Thank you so much for your help. I really appreciate it.

Re: headers in csv do not appear as field names in search result

MuS — Tue, 16 Dec 2014 12:50:25 GMT

Sweet 🙂 You're welcome ...