topic Re: Can't index a .csv file?!? in Getting Data In

Can't index a .csv file?!?

Jochen_1987 — Thu, 23 Aug 2012 13:23:39 GMT

Hey,
I tried to index a .csv file several times and I can see the file in
"Manager » Data inputs » Files & directories" but I can't find it?!?!
I tried a different file and directory and there was the same result...
I can also see all indexes due to the settings of "Access controls » Roles".
To make a long story short I have no idea why i can't find the files that are indexed....

Re: Can't index a .csv file?!?

MuS — Thu, 23 Aug 2012 13:50:21 GMT

Hi Jochen

is your input index into another then the default index?

if so, do you search the correct index?

what does splunkd.log report?

have you searched index=_internal for the file in question?

cheers,

MuS

Re: Can't index a .csv file?!?

Jochen_1987 — Fri, 24 Aug 2012 06:11:25 GMT

Hi,
Input index is default index... Splunkd.log reports "TailingProcessor - Parsing configuration stanza: monitor:C:..." and I searched index=_internal and then the path of the file but there were no results..

Re: Can't index a .csv file?!?

MuS — Fri, 24 Aug 2012 06:29:03 GMT

it could also be a permission problem, meaning the user splunk is running is not allowed to read the file.
try searching for the file name in index=_internal instead of path name.

Re: Can't index a .csv file?!?

Jochen_1987 — Fri, 24 Aug 2012 06:38:13 GMT

no result... the thing is I already indexed the file a few days ago but then deleted it... could that be the problem? and if i want to upload a file that's fine, i just got problems if i want to monitor a file/directory...

Re: Can't index a .csv file?!?

MuS — Fri, 24 Aug 2012 06:47:33 GMT

okay, splunk will not index this file again in this case.
just make sure there is no permission problem and the path is accessible for splunk, then it should be fine. do you use any regex for this input and props/transforms as well?
could you post the stanza from inputs.conf?

Re: Can't index a .csv file?!?

Ayn — Fri, 24 Aug 2012 06:55:00 GMT

That could very well be the problem. Splunk keeps track of how far into the file it has read. If you delete the file and reupload it, it will not be reindexed. Some more information is available here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Howlogfilerotationishandled

Re: Can't index a .csv file?!?

Jochen_1987 — Fri, 24 Aug 2012 07:29:57 GMT

ok, now I now why it doesn't work, but how do i get the data back in splunk:-)?

Re: Can't index a .csv file?!?

MuS — Fri, 24 Aug 2012 08:08:57 GMT

try this -> http://splunk-base.splunk.com/answers/27230/what-is-the-best-method-to-reindex-the-file-after-deleting-the-data

Re: Can't index a .csv file?!?

proletariat99 — Mon, 24 Mar 2014 21:33:28 GMT

same problem here. I've put it in default, main, created my own new index, given it default sourcetypes and custom sourcetypes and it just doesn't appear anywhere.

Never indexed, never uploaded, as far as I can tell. What gives?

Re: Can't index a .csv file?!?

ryantzj — Mon, 12 Oct 2015 01:17:43 GMT

Having a very similar problem on my side, May i know what you did to resolve this.

Re: Can't index a .csv file?!?

MuS — Mon, 12 Oct 2015 01:21:28 GMT

@ryantzj, see this answer http://answers.splunk.com/answers/27230/what-is-the-best-method-to-reindex-the-file-after-deleting-the-data.html