topic make a table for a csv in Splunk Search

make a table for a csv

Soonerseast — Fri, 13 Jun 2025 13:59:42 GMT

Hi my data is comma delimited , there are 2 rows with a header. I'fd like the columns to be split by the comma into a more readable table. Thanks

LOG_SEQ,LOG_DATE,LOG_PKG,LOG_PROC,LOG_ID,LOG_MSG,LOG_ADDL_MSG,LOG_MSG_TYPE,LOG_SQLERRM,LOG_SQLCODE,LOG_RECEIPT_TABLE_TYPE,LOG_RECEIPT_NUMBER,LOG_BATCH_NUMBER,LOG_RECORDS_ATTEMPTED,sOG_RECORDS_SUCCESSFUL,LOG_RECORDS_ERROR, 37205289,20250612,import_ddd,proposal_dataload (FAS),,GC Batch: 615 Rows Rejected 6,,W,,0,,,,0,0,0 37205306,20250612,hu_givecampus_import_HKS,proposal_dataload (HKS),,GC Batch: 615 - Nothing to process. Skipping DataLoader operation,,W,,0,,,,0,0,0 37205315,20250612,ddd,assignment_dataload (FAS),,GC Batch: 615 Rows Rejected 3,See harris.hu_gc_assignments_csv,W,,0,,,,0,0,0

I've tried a few things , currently I have :

<query>((index="splunkdata-dev") source="/d01/log/log_splunk_feed.log" )

| eval my_field_split = split(index, ",") , log_seq = mvindex(my_field_split, 0)

, log_date = mvindex(my_field_split, 1)

,log_pkg= mvindex(my_field_split, 2)

,log_proc = mvindex(my_field_split, 3)

,log_msg = mvindex(my_field_split, 4)

,log_addl_msg= mvindex(my_field_split, 6)

, log_msg_type = mvindex(my_field_split, 7)

,log_sqlerrm = mvindex(my_field_split, 😎

, log_sqlcode= mvindex(my_field_split, 9) | table [|makeresults | eval search ="log_seq log_date log_pkg log_proc log_id log_msg log_addl_msg log_msg_type log_sqlerrm log_sqlcode" | table search ] table

Re: make a table for a csv

richgalloway — Fri, 13 Jun 2025 14:13:05 GMT

Please put the query in a code block so it's easier to read and to avoid it being rendered in emoticons.

How is this query not working for you? What are the expected results and what results so you get?

The split function should not be using 'index' as the first argument. The value of that field, "splunkdata-dev" does not contain any commas. You probably should use _raw.

What is the intention of the subsearch in the table command?

Re: make a table for a csv

gcusello — Fri, 13 Jun 2025 14:14:51 GMT

Hi @Soonerseast ,

why are you not using the INDEXED_EXTRACTION = csv?

anyway, you can put in props.conf:

[your_sourcetype] HEADER_FIELD_LINE_NUMBER=1 FIELD_DELIMITER=, FIELD_QUOTE="

if eventually, yo don't need the header as an event, you can remove it,

Ciao.

Giuseppe

Re: make a table for a csv

yuanliu — Fri, 13 Jun 2025 15:44:39 GMT

As I always say, do not treat structured data like text. split is not the tool for this job. @gcusello suggests INDEXED_EXTRACTION and a way to set up extraction in props.conf. Short of these, you can also use multikv

| multikv