CHECK_FOR_HEADER identifying incorrect delimiter in CSV header

scaster — Mon, 28 Sep 2020 11:45:56 GMT

We have a system, Splunk 4.2.1 (build 98164), that scans a directory to read in CSV files, which include comma-delimited header lines.

This usually works fine, but periodically, instead of properly interpreting the header line, the CHECK_FOR_HEADER/AutoHeader function identifies a space as the delimiter, even though there are no spaces in the header line, and creates an AutoHeader in which the entire comma-delimited header is identified as one big field name:

[AutoHeader-11]
DELIMS = " "
FIELDS = "SessionID,AnalyzerIP,AnalyzerID,PopNm,TimeStamp,Date,Hour,Minute,TzOfstMins,TzDst,TzNm,TzDstNm,ClientIP,ServerIP,Protocol,Tag,TimeStampFrac,ProtocolEventID,ID,Proto,Type,Name,Class,TTL,Rdata"

The line in the file is perfectly ordinary, formatted identically to header lines that are processed correctly. In fact, earlier in transforms.conf, the exact same header is identified correctly:

[AutoHeader-7]
DELIMS = ","
FIELDS = "SessionID", "AnalyzerIP", "AnalyzerID", "PopNm", "TimeStamp", "Date", "Hour", "Minute", "TzOfstMins", "TzDst", "TzNm", "TzDstNm", "ClientIP", "ServerIP", "Protocol", "Tag", "TimeStampFrac", "ProtocolEventID", "ID", "Proto", "Type", "Name", "Class", "TTL", "Rdata"

Does anyone have any idea what could cause this?

Re: CHECK_FOR_HEADER identifying incorrect delimiter in CSV header

ogdin — Thu, 13 Feb 2014 17:01:34 GMT

We've deprecated CHECK_FOR_HEADER in Splunk 6 and replaced it with more robust header controls. See:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileheadersatindextime

topic Re: CHECK_FOR_HEADER identifying incorrect delimiter in CSV header in Getting Data In

CHECK_FOR_HEADER identifying incorrect delimiter in CSV header

Re: CHECK_FOR_HEADER identifying incorrect delimiter in CSV header