topic Re: index empty csv file in Getting Data In

index empty csv file

surekhasplunk — Mon, 16 Apr 2018 10:41:40 GMT

Hi,

I want to know if i can index a csv file with just the headers without any data in it.

If i search for index=indexname what will i see. and if i try to export the same to a outputfile while will be generated in the output file.

Thanks

Re: index empty csv file

jvardev — Mon, 16 Apr 2018 11:01:06 GMT

You can index it, but wont see nothing at search time. I have imported a file with header and without data with Splunk Enterprise 7.0.3.

Re: index empty csv file

p_gurav — Mon, 16 Apr 2018 11:51:52 GMT

Could you please tell me the requirement to do this?

Re: index empty csv file

surekhasplunk — Mon, 16 Apr 2018 12:02:22 GMT

hi @p_gaurav,

I just want to index a file which has no data in it and just the headers. so that when i search for the index on the seach head i just get the headers shown without any data and the csv generated should have just the headers with no data

Re: index empty csv file

adonio — Mon, 16 Apr 2018 14:09:57 GMT

like @p_gurav mentioned, i am not sure regarding this requirement
also, when indexing a csv file, splunk will avoid the header if there is no values under it.
you can try and use the lookup editor app or use a lookup for this requirement.
hope it helps

Re: index empty csv file

somesoni2 — Mon, 16 Apr 2018 15:24:28 GMT

Assuming you've correct configuration to parse the file data as CSV, and empty-file/just-headers, will not get indexed. Splunk stores raw data with metadata information not just the metadata. Since no results will be shown at search, you won't be able to export or outputfile or outputcsv.

Re: index empty csv file

surekhasplunk — Tue, 17 Apr 2018 08:43:45 GMT

Perfect...

thanks @somesoni2 . You explained really well.

Re: index empty csv file

ssadanala1 — Tue, 17 Apr 2018 12:21:30 GMT

If you want to create lookup file as place holder

you can create a null file by running this in search

|outputlookup yourplaceholderlookupname.csv