topic Re: CSV Field indexing in Knowledge Management

CSV Field indexing

TISKAR — Wed, 28 Aug 2024 14:55:22 GMT

Hello,

I have a CSV file that I monitor via the Universal Forwarder (UF). I’m encountering an issue where sometimes I cannot find the fields in Splunk when i run index=myindex, even though they appear on other days.

The CSV file does not contain a header, and the format of the file is the same every day (each day starts with an empty file that is populated later). Here is the props.conf configuration that I’m using:

[csv_hff] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = FIELD_NAMES = heure,id,num,id2,id3 INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TIMESTAMP_FIELDS = heure TIME_FORMAT = %d/%m/%Y %H:%M:%S category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true

Has anyone else encountered the same problem?

Splunk version 9

Thank you

Re: CSV Field indexing

PickleRick — Wed, 28 Aug 2024 18:42:12 GMT

But are the events indexed but the fields are not extracted or are the events not ingested at all?

Re: CSV Field indexing

TISKAR — Wed, 28 Aug 2024 20:18:36 GMT

@PickleRick @ Events are indexed, but fields are not extracted for the same day. For other days, there is no problem

Re: CSV Field indexing

PickleRick — Thu, 29 Aug 2024 18:10:49 GMT

Check those events - my hunch is there is something wrong with formatting in those rows - some inconsistent quoting or something like that.