topic Re: Prop Conf for CSV input data in Splunk Search

Prop Conf for CSV input data

SplunkDash — Thu, 15 Jul 2021 20:45:51 GMT

Hello,

Please let me know how I would write Props Configuration file for this csv file. Segment of sample data for this csv file is given below. Any help will be highly appreciated, thank you!

Re: Prop Conf for CSV input data

codebuilder — Thu, 15 Jul 2021 20:58:05 GMT

Since you have structured data with a header you can use the built-in CSV sourcetype. Just set sourcetype = csv inputs.conf on your forwarder.

Or you can create a custom one using INDEXED_EXTRACTIONS = csv
See the documentation below for details and additional settings.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Extractfieldsfromfileswithstructureddata#Use_configuration_files_to_enable_automatic_header-based_field_extraction

Re: Prop Conf for CSV input data

SplunkDash — Thu, 15 Jul 2021 21:28:39 GMT

Thank you. But, I used

DATETIME_CONFIG=current

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

NO_BINARY_CHECK=true

CHARSET=UTF-8

EVAL-_raw=replace(_raw,"\"","")

INDEXED_EXTRACTIONS=csv

KV_MODE=none

category=Structured

but, showing no events.......when I take off "DATETIME_CONFIG=current" and leave this value blank... it's showing events with error messages ("Failed to parse timestamp"). Any help will be highly appreciated.

Re: Prop Conf for CSV input data

codebuilder — Thu, 15 Jul 2021 21:49:23 GMT

Where are you putting this? Also, why are you doing replacements on _raw?

Re: Prop Conf for CSV input data

SplunkDash — Thu, 15 Jul 2021 21:54:47 GMT

_raw just generated automatically from the system when I pull the source file through SPLUNK web console to test my PROPS. It doesn't make any differences if I take off take option

Re: Prop Conf for CSV input data

venkatasri — Thu, 15 Jul 2021 23:33:39 GMT

Hi @SplunkDash

can you try this and deploy it to UF not on HF/intermediate forwarder. Restart UF.

## props.conf [your_sourcetype] HEADER_FIELD_LINE_NUMBER = 1 INDEXED_EXTRACTIONS = CSV DATETIME_CONFIG = CURRENT

An upvote would be appreciated and Accept the solution if this reply helps!