topic Re: How can I extract fields based on headers from a CSV file in .gz format? in Splunk Search

How can I extract fields based on headers from a CSV file in .gz format?

jkponnuri — Tue, 04 Aug 2015 16:12:05 GMT

I tried providing a csv file location in inputs.conf,

[monitor:///path/to/*.csv.gz]
source = testcsv
sourcetype = testcsvlog

and in props.conf

FIELD_DELIMITER=,

RAW data:

"Field1", "Field2","Field3" ,"Field4"
"value1","value2","value3","value4"

But I am unable to view the fields based on headers. Please help.

Re: How can I extract fields based on headers from a CSV file in .gz format?

frobinson_splun — Tue, 04 Aug 2015 16:29:25 GMT

Hello @jkponnuri,
I am a tech writer at Splunk and I'd like to help with your question. I wanted to suggest a couple of documentation topics as a start.
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Aboutindexedfieldextraction

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime

Hope this helps! Let me know, either way, and we can continue troubleshooting.

All best,
@frobinson_splunk

Re: How can I extract fields based on headers from a CSV file in .gz format?

jnussbaum_splun — Tue, 04 Aug 2015 16:33:48 GMT

I just tested a gzip'd .csv file, and got proper extraction with the following inputs stanza:
[monitor:///tmp/*.gz]
index = main
sourcetype = csv

the sourcetype as csv should do it.

Re: How can I extract fields based on headers from a CSV file in .gz format?

frobinson_splun — Tue, 04 Aug 2015 21:32:37 GMT

Great, glad you got that working!

Re: How can I extract fields based on headers from a CSV file in .gz format?

jkponnuri — Wed, 05 Aug 2015 02:09:16 GMT

Hi, Thanks for the answer. I tried now. Hope it should work. I will update you once it work. Thanks again.

Re: How can I extract fields based on headers from a CSV file in .gz format?

frobinson_splun — Wed, 05 Aug 2015 23:24:45 GMT

Great--do let me know how it turns out!
All best,
@frobinson_splunk

Re: How can I extract fields based on headers from a CSV file in .gz format?

jkponnuri — Tue, 01 Sep 2015 06:50:40 GMT

Hi, for normal csv file it's working fine. But filename.csv.gz it didn't work as expected. Please let me know for. Gz file extension any other process we need to follow?
Thanks.

Re: How can I extract fields based on headers from a CSV file in .gz format?

jkponnuri — Fri, 04 Sep 2015 07:05:36 GMT

Hi,

Sorry for delay reply. I tried this but csv files are working fine. But not csv.gz files. I am.unable to get field name based on headers.

Thanks,

Re: How can I extract fields based on headers from a CSV file in .gz format?

jkponnuri — Tue, 08 Sep 2015 06:00:54 GMT

Somehow managed to work by using sourcetype=csv-2
It did worked as expected. Thanks..