topic Re: How to create a search out of an imported csv file in Getting Data In

How to create a search out of an imported csv file

splunkman341 — Wed, 17 Jun 2015 18:25:44 GMT

Hi guys,

So I have just imported a csv file that has two kinds of information : Label & ID number. Now, I am trying to create a search to add into my dashboard that displays the Label and not the ID number.

The xml file's info is as shows right here:

Sorry for the long list. Can someone please help?

Thanks in advance for your help!

Re: How to create a search out of an imported csv file

woodcock — Wed, 17 Jun 2015 19:36:01 GMT

Like this:

| inputcsv YourFileName | stats values(id) AS IDs

Or maybe like this

| inputcsv YourFileName | table id

Be sure to use the correct capitalization for id (your question is ambiguous on this).

Re: How to create a search out of an imported csv file

splunkman341 — Wed, 17 Jun 2015 19:57:45 GMT

Thanks for your answer. I tried doing inputcsv categoryLabels | stats values(Label) AS Label- but it would not execute. I am not interested in the ID field, but instead, the label field.

I also have tried inputcsv categoryLabels | table label also did not work.

Also, do I need to include the .csv in my file name? The whole file name is categoryLabels.csv

Re: How to create a search out of an imported csv file

woodcock — Wed, 17 Jun 2015 20:07:36 GMT

Sorry about swapping the fields. Yes, you need the exact filename with extension AND it has to be in the proper place as indicated here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/inputcsv

Re: How to create a search out of an imported csv file

splunkman341 — Wed, 17 Jun 2015 20:27:44 GMT

hmm its still not displaying any information at all even without the parameters. Was I suppose to do something else after adding it into my lookups?

Re: How to create a search out of an imported csv file

woodcock — Wed, 17 Jun 2015 20:35:40 GMT

You are missing the leading pipe character |; it is critically important to type it exactly as shown:

| inputcsv categoryLabels.csv | table label

Re: How to create a search out of an imported csv file

splunkman341 — Wed, 17 Jun 2015 20:42:19 GMT

It's still giving me the same result as the previous times. " No results found"

Re: How to create a search out of an imported csv file

woodcock — Wed, 17 Jun 2015 20:48:27 GMT

Did you read the dox about where the file must be? If the file is not found, you will not get a "file not found" message, you will get "No results found". I am sure the problem is that you do not have the file in the correct place so that Splunk can find it. Where is the file now?

Re: How to create a search out of an imported csv file

splunkman341 — Wed, 17 Jun 2015 20:51:09 GMT

Inside Settings > lookups...

The file is not on the physical server that is running Splunk.

Re: How to create a search out of an imported csv file

woodcock — Wed, 17 Jun 2015 21:01:30 GMT

It has to be a physical file on the Search Head. You can probably do the same thing with KV Store but I am not up to speed on it yet.

Re: How to create a search out of an imported csv file

splunkman341 — Thu, 18 Jun 2015 14:17:09 GMT

So it is not possible to search for this file unless it is on the physical server?

Re: How to create a search out of an imported csv file

woodcock — Thu, 18 Jun 2015 14:44:45 GMT

YES! That is why I said this at the VERY beginning:

AND it has to be in the proper place as indicated here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/inputcsv

Re: How to create a search out of an imported csv file

woodcock — Fri, 31 Jul 2015 15:10:55 GMT

If you are clear on all this now, please "Accept" an answer to close off the question.