topic Re: Uploading a CSV with multiline field value in Splunk Search

Uploading a CSV with multiline field value

ChhayaV — Mon, 05 Aug 2013 04:27:15 GMT

hi,

I want to do a lookup to a CSV file which is having multi line field value when i upload a file for lookup its givng me error as file is in binary format.
How can i upload such CSV or is there any other way to do lookup for fields with multi line value?

Thanks and regards

Re: Uploading a CSV with multiline field value

rsennett_splunk — Mon, 05 Aug 2013 05:14:53 GMT

It isn't completely clear from what you've said, but is the file a comma delimited text file or is it something else? Does it contain binary characters? Can you open it and edit it in a text editor?

It would also help to provide a sample of the file here so we are clear on what you mean by multiline exactly.

Re: Uploading a CSV with multiline field value

ChhayaV — Mon, 05 Aug 2013 05:22:19 GMT

hi,
yea its a comma delimited file and i am able to edit in text editor.
Sample entry in file

message
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible

solution
try below options, set command timeout parameter to 0. It will execute till the end. By default it will timeout in 30 secs.
sqlComm.CommandTimeout = 0

where "mesasge" and "solution" are two filed in my csv

Re: Uploading a CSV with multiline field value

rsennett_splunk — Mon, 05 Aug 2013 06:27:19 GMT

There is no problem with the structure, so I wonder if there are hidden binary characters that are inhibiting the upload. you might want to see if you text editor can reveal hidden characters so you can clean them up if need be.
The exact error will help as well.

Re: Uploading a CSV with multiline field value

sowings — Mon, 05 Aug 2013 13:10:12 GMT

I created a lookup like this (note the quotes):

field,value "key","This is a multi-line string that lives in a CSV file."

It worked just fine, but the search results (| inputlookup foo.csv) ended up eliding the newlines, so the "value" side came out as just a long string.

Could it be that your multi-line values are not quoted?