https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494101#M84388 <P>4,633 is rows is not too large for a UF. Does the forwarder log any errors? Is the customer filtering any data from the file/sourcetype?</P> Wed, 29 Jan 2020 18:43:28 GMT richgalloway 2020-01-29T18:43:28Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494100#M84387 <P>My customer has some very large csv files that are only updating about 200 events/rows of the data into Splunk. </P> <P>"As per checking MDMS-001_Meter Reads Requested file have 4,633, but in Splunk it only have 208 events. "</P> <P>How can I get the entire csv file to upload? I am using universal forwarders for the ingest.</P> Wed, 29 Jan 2020 18:31:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494100#M84387 nls7010 2020-01-29T18:31:10Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494101#M84388 <P>4,633 is rows is not too large for a UF. Does the forwarder log any errors? Is the customer filtering any data from the file/sourcetype?</P> Wed, 29 Jan 2020 18:43:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494101#M84388 richgalloway 2020-01-29T18:43:28Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494102#M84389 <P>Those are pretty small files. I regularly upload csv files that are several million records without any issues.</P> <P>You probably have a parsing error of some sort. </P> <P>Get a sample file, and try a manual ingestion. If it is not resolving, that probably indicates that there is a formatting error with the csv file itself. Look for invalid data fields. </P> Fri, 31 Jan 2020 22:49:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494102#M84389 DalJeanis 2020-01-31T22:49:22Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494103#M84390 <PRE><CODE>| makeresults | eval _raw="your_csv_copy_and_paste ....." | multikv forceheader=1 | table your_csv_header </CODE></PRE> <P>maybe, works.</P> <P>Why not use <CODE>collect</CODE> OR <CODE>outputcsv</CODE> as needed?</P> Sat, 01 Feb 2020 00:49:02 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-upload-a-very-large-csv-file-into-Splunk/m-p/494103#M84390 to4kawa 2020-02-01T00:49:02Z