Deployment Architecture

CSV Extraction

shugup2923
Path Finder

I have a csv with data as below- 

Timestamp Total Capacity Used Capacity Available Capacity Percentage Used
9/30/2020 11:11 209.34 TB 201.46 TB 7.88 TB96.24%


my inputs.conf is -
[monitor://F:\Storage\Tools\CTW\MSA\MSA_FSutilization.csv]
sourcetype=csv_use_current_date
disabled=false
index=storage
crcSalt=<SOURCE>

props.conf -
[csv_use_current_date]
DATETIME_CONFIG = CURRENT
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = 1

fields are not extracted properly, getting full data in single field-

Any Suggestion ??

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @shugup2923,

what's the field delimiter of your csv?

If it isn't "," (default), you have to set in props.conf :

FIELD_DELIMITER=<your_field_delimiter>

One hint: if possible, avoid spaces in field names.

Ciao.

Giuseppe

0 Karma

shugup2923
Path Finder

My issue got resolved, issue was with field_delimiter , it was tab and I was missing that

0 Karma

gcusello
Esteemed Legend

Hi @shugup2923,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...