Deployment Architecture

CSV Extraction

shugup2923
Path Finder

I have a csv with data as below- 

Timestamp Total Capacity Used Capacity Available Capacity Percentage Used
9/30/2020 11:11 209.34 TB 201.46 TB 7.88 TB96.24%


my inputs.conf is -
[monitor://F:\Storage\Tools\CTW\MSA\MSA_FSutilization.csv]
sourcetype=csv_use_current_date
disabled=false
index=storage
crcSalt=<SOURCE>

props.conf -
[csv_use_current_date]
DATETIME_CONFIG = CURRENT
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

fields are not extracted properly, getting full data in single field-

Any Suggestion ??

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

0 Karma

shugup2923
Path Finder

My issue got resolved, issue was with field_delimiter , it was tab and I was missing that

0 Karma

gcusello
Esteemed Legend

Hi @shugup2923,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...