topic Re: csv file could not be read. in Getting Data In

csv file could not be read.

pallavibalasa — Mon, 29 Aug 2016 07:38:55 GMT

I created a csv file and placed in splunk/var/run/splunk/csv/ folder and using the command |inputcsv filename.csv

I am unable to get the results. It says file could not be read. I have not applied any restrictions to the file. Please provide me with detailed steps on what to check .
I guess I am missing something here.

Regards,
Pallavi

Re: csv file could not be read.

vivek_manoj — Mon, 29 Aug 2016 13:42:49 GMT

In this you have to map the field name in the csv file with the field name you want to .
For ex. use
sourcetype=abc|lookup filename.csv field1=FIELD1 field2=FIELD2....

It is created before using lookups command.

Re: csv file could not be read.

renjith_nair — Mon, 29 Aug 2016 13:55:41 GMT

Check the permission of the file. Make sure that the file exists and is readable by the splunk user

Re: csv file could not be read.

vasanthmss — Tue, 30 Aug 2016 16:23:56 GMT

Place it in $splunk_home/etc/apps/search/lookup/

Run csv folder is for outputcsv

web ui to import and check where the files are imported. Why do you want to place the field in run - csv??

For further details check the below URL,
http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/ConfigureCSVlookups

Re: csv file could not be read.

pallavibalasa — Wed, 31 Aug 2016 11:26:01 GMT

This issue is solved. I changed the permissions of the folder in which the file resides. Now i can read and write to the file.

Thanks for all responses.