Deployment Architecture

CSV Extraction

shugup2923
Path Finder

I have a csv with data as below- 

Timestamp Total Capacity Used Capacity Available Capacity Percentage Used
9/30/2020 11:11 209.34 TB 201.46 TB 7.88 TB96.24%


my inputs.conf is -
[monitor://F:\Storage\Tools\CTW\MSA\MSA_FSutilization.csv]
sourcetype=csv_use_current_date
disabled=false
index=storage
crcSalt=<SOURCE>

props.conf -
[csv_use_current_date]
DATETIME_CONFIG = CURRENT
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

fields are not extracted properly, getting full data in single field-

Any Suggestion ??

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

0 Karma

shugup2923
Path Finder

My issue got resolved, issue was with field_delimiter , it was tab and I was missing that

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shugup2923,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...