We have a new Splunk Cloud environment
We are using AWS TA Add On to ingest files from S3
The files have extension of ".csv" but they are not really CSV, they are TSV (tab separated values).
The Add-On has built-in functionality to inspect CSV files and tried to convert them to json, therefore it fails to ingest them correctly.
Is there any way to turn-off the CSV parsing ability of the S3 input?
Try adding to your input:
parse_csv_with_header=0