topic Why fields from CSV are not being extracted? in Splunk Search

Why fields from CSV are not being extracted?

rbacon — Fri, 01 Aug 2014 19:20:10 GMT

I'm getting data from forwarders that are polling a CSV file. However the fields from the CSV are not being extracted. The file contents look something like: "FieldOne","FieldsTwo","FieldThree","FieldFour".

On the deploy server I have configured an app that gets deployed to all of the indexers and forwarders and the data is indexed into a new sourcetype and a new index. Following are the configurations that are deployed to the indexers and forwarders:

inputs.conf

[monitor://D:\Program Files (x86)\reports\splunk\lists.csv]
disabled = false
followTail = 0
index = lists
sourcetype = lists:reports

props.conf

[source::D:\Program Files (x86)\reports\splunk\lists.csv]

[lists:reports]
FIELD_DELIMITER=,
FIELD_QUOTE = "
DATETIME_CONFIG = CURRENT
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false

I didn't configure a transforms.conf file. Thanks for your help!

Re: Why fields from CSV are not being extracted?

gschmitz — Thu, 04 Sep 2014 08:33:44 GMT

Hi,

I think I have the same problem. Did you manage to solve yours?

http://answers.splunk.com/answers/154071/csv-is-not-extracted-at-index-time

Re: Why fields from CSV are not being extracted?

MuS — Thu, 04 Sep 2014 09:04:49 GMT

Hi rbacon & gschmitz,

I think the problem is your (x86) in the path, which will be handled as regex see the docs about Specify input paths with wild cards.
Try using quotes around the path and / or use this fancy tool http://blogs.splunk.com/?s=christmas to debug.

hope this helps ...

cheers, MuS

Re: Why fields from CSV are not being extracted?

chris — Sun, 07 Sep 2014 19:24:16 GMT

You are on Splunk 6 right (indexers & forwarders)? And there aren't any entries in the learned app that might interfer?

Re: Why fields from CSV are not being extracted?

gschmitz — Mon, 08 Sep 2014 01:46:57 GMT

Unfortunately no.

Re: Why fields from CSV are not being extracted?

Lamar — Mon, 28 Sep 2020 19:44:59 GMT

I recently had this same problem. The way I fixed it was by removing the FIELD_DELIMITER argument. I don't think it's something that you need since you're already defining what the delimiter is with 'INDEXED_EXTRACTIONS = csv'.

This behavior could be a bug or an intended feature of the configuration. FIELD_DELIMITER, I believe, is designed to allow the use of additional special characters in the event that one of the default INDEXED_EXTRACTIONS values aren't what your data supports.