Loading a comma seperated values file without headers into SPLUNK with custom headers

[nageshreddy81]

I have to load a file from hadoop into SPLUNK which are comma separated with no headers. I want to display results with the field headers. Can some guide me the process/steps for adding the headers.

I am using Hadoop Connect app for the above.

[sideview]

You'll want to set up an AutoHeader stanza in transforms.conf for your sourcetype.

It's a smaller part of the overall check_for_header config ( http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Extractfieldsfromfileheadersatindextime ) And although you have no header to check, you can still manually set up the autoheader so that the fields all get extracted, and with the right field names assuming you know the field names.

Assuming for the moment that your sourcetype is called "mySourcetype", This would go in transforms.conf

[AutoHeader-mySourcetype]
FIELDS="foo", "bar", "anotherfoo", "anotherbar"
DELIMS=","

and add this to props.conf, under the stanza [mySourcetype]. If there already is a [mySourcetype] stanza, just add the REPORT line under the existing stanza by itself.

[mySourcetype] 
REPORT-AutoHeader = AutoHeader-mySourcetype

[sideview]

Maybe try modifying the config in splunk/etc/system/local, rather than just in the user directory. It seems unlikely to be the cause but it shouldn't be hidden in a user dir.

I would also explicitly give your data a sourcetype. Just make up a sourcetype name and stick with it. The "ini-too_small" name means that you asked Splunk to figure it out, it couldn't and furthermore the file wasn't big enough for it to get a proper signature. It has fallback behavior to take the file extension and tack on "too_small", but the resulting sourcetype may be a little strange, I dont know.

[nageshreddy81]

I tried to make the changes as suggested by you, but it does not work 😞

Following is sample data, although the actual data is complicated, this is for test purpose.
File Name is "comma.ini"
nagesh,test
nagesh,test1

My props.conf entry:
[ini-too_small]
REPORT-AutoHeader = AutoHeader-ini-too_small

My transforms.conf entry:
[AutoHeader-ini-too_small]
FIELDS="foo", "bar"
DELIMS=","

The sourcetype ini-too_small is assigned by splunk automatically.

I have modified props.conf and transforms.conf in the splunk/etc/users/admin/search/local

Let me know were i am going wrong here.