Getting Data In

AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability?

ehudb
Contributor

We have a new Splunk Cloud environment

We are using AWS TA Add On to ingest files from S3

The files have extension of ".csv" but they are not really CSV, they are TSV (tab separated values).

The Add-On has built-in functionality to inspect CSV files and tried to convert them to json, therefore it fails to ingest them correctly.

Is there any way to turn-off the CSV parsing ability of the S3 input?

Source:
https://docs.splunk.com/Documentation/AddOns/released/AWS/S3

"The Generic S3 custom data types input ...

Labels (1)
Tags (3)
0 Karma

mmwilson0
Explorer

Try adding to your input:

parse_csv_with_header=0

 

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...