Why is there a problem parsing empty CSV file which only contain a header?

danje57 — Mon, 12 Feb 2018 14:17:35 GMT

Hi,

I receive log file from my servers.

All files are CSVs.

CSVs which contain header + data are well parsed.
However, CSV which are empty an contain only the header following with nothing are not parsed correctly.

Indeed, when empty file are parsed, Splunk parses the headers of the CSV as data.

This is not the bahavior I want.

When I configure the source, I checked to ignore the first line as the first line is always the header.

Do you have any suggestion?

[csv_ad]
DATETIME_CONFIG =
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS =

Re: Why is there a problem parsing empty CSV file which only contain a header?

adonio — Wed, 14 Feb 2018 18:19:14 GMT

hello there,

please read here:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Extractfieldsfromfileswithstructureddata#Only_header_fields_containing_data_are_indexed
maybe worthwhile to work with "no headers"
this answer explains it in more detail:
https://answers.splunk.com/answers/5404/best-way-to-define-fields-for-a-csv-with-no-headers.html

hope it helps

topic Re: Why is there a problem parsing empty CSV file which only contain a header? in Getting Data In

Why is there a problem parsing empty CSV file which only contain a header?

Re: Why is there a problem parsing empty CSV file which only contain a header?