https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160906#M32618 <P>Events in the event viewer will generally be blank unless they include a _raw field. Your sv file probably does not have a field (or column) called _raw, which is the text of the event.</P> Mon, 13 Oct 2014 20:32:57 GMT jrodman 2014-10-13T20:32:57Z https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160905#M32617 <P>Hi all, when i do an inputcsv command, I see the data in the file I put on the splunk server. Since I want to see them as events I query the following:<BR /> <CODE>| inputcsv filename.csv</CODE> (I see all the data, 7603 counted)<BR /> <CODE>| inputcsv start=1 events=yes filename.csv</CODE> (I get the 7602 count, but showing all blank)</P> <P>Any ideas why its showing blanks?</P> Mon, 13 Oct 2014 15:01:00 GMT https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160905#M32617 ycalpu 2014-10-13T15:01:00Z https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160906#M32618 <P>Events in the event viewer will generally be blank unless they include a _raw field. Your sv file probably does not have a field (or column) called _raw, which is the text of the event.</P> Mon, 13 Oct 2014 20:32:57 GMT https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160906#M32618 jrodman 2014-10-13T20:32:57Z https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160907#M32619 <P>jrodman, how do you designate the _raw field?</P> <P>Y</P> Thu, 16 Oct 2014 13:30:06 GMT https://community.splunk.com/t5/Getting-Data-In/When-I-use-the-inputcsv-command-with-my-data-I-see-an-eventcount/m-p/160907#M32619 ycalpu 2014-10-16T13:30:06Z