topic csv couldn't be opened for reading in Getting Data In

csv couldn't be opened for reading

zacksoft — Mon, 20 May 2019 09:48:38 GMT

My csv is placed on desktop
So I am using | inputcsv "C:/Users/JM/Desktop/rap.csv"
Splunk is not able to read. It says the csv couldn't be opened for reading.
I tried this before couple of months back with a similar .csv and it had worked. not sure why is it not working this time...unable to figure out why it is unable to read.

Re: csv couldn't be opened for reading

koshyk — Mon, 20 May 2019 09:55:47 GMT

You need to upload the CSV into Splunk
1. Via GUI => Just navigate to splunkURL/manager/search/lookups and upload the CSV. Put a name to it (like rap.csv)
Give permissions accordingly if you want to share to other users.

Then in the GUI, just do a

|inputlookup rap.csv

2.If you want to do it via backend, ensure that you upload the CSV via GUI. It normally comes to an app (like search app) or your own app. Just update the CSV in $SPLUNK_HOME/etc/apps/<your_app>/lookups/rap.csv

Re: csv couldn't be opened for reading

zacksoft — Mon, 20 May 2019 10:05:10 GMT

Thank you very much.