topic How do I add fields to incoming data? in Getting Data In

How do I add fields to incoming data?

raghu0463 — Fri, 25 Jan 2019 02:02:34 GMT

Hi,

I'm trying to load a CSV file using the universal forwarder, and there are no headers in the CSV file. How can I give column names to those values in the file? Can I do that at props.conf? I don't want to use the extract field option...

eg : file.csv as below values

1,2,3,4,5
6,7,8,9,10
11,12,13,14,15

Re: How do I add fields to incoming data?

renjith_nair — Fri, 25 Jan 2019 03:39:12 GMT

@raghu0463 ,

You can configure them in props.conf

[your sourcetype for csv file]
FIELD_NAMES =field1,field2,.....

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extraction_and_configuration

Re: How do I add fields to incoming data?

raghu0463 — Fri, 25 Jan 2019 05:19:20 GMT

how does it identifies from which source and file ? if I just mention only csv

i.e
[csv]
FIELD_NAMES = A,B,C,D,E

Re: How do I add fields to incoming data?

renjith_nair — Fri, 25 Jan 2019 06:43:51 GMT

@raghu0463 , thats what meant by [your sourcetype for csv file]. You need to set a sourcetype for your file based on the content. Or you can use source/host in the SPEC

Common SPEC

[<spec>]
* This stanza enables properties for a given <spec>.
* A props.conf file can contain multiple stanzas for any number of
  different <spec>.
* Follow this stanza name with any number of the following setting/value
  pairs, as appropriate for what you want to do.
* If you do not set an setting for a given <spec>, the default is used.

<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
                 event.
3. source::<source>, where <source> is the source, or source-matching
                     pattern, for an event.

Re: How do I add fields to incoming data?

nickhills — Fri, 25 Jan 2019 09:58:27 GMT

if you want to define the stanza by the source file name you can use:

[source::/path/to/file.csv]
FIELD_NAMES = A,B,C,D,E