Getting Data In

AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability?

ehudb
Contributor

We have a new Splunk Cloud environment

We are using AWS TA Add On to ingest files from S3

The files have extension of ".csv" but they are not really CSV, they are TSV (tab separated values).

The Add-On has built-in functionality to inspect CSV files and tried to convert them to json, therefore it fails to ingest them correctly.

Is there any way to turn-off the CSV parsing ability of the S3 input?

Source:
https://docs.splunk.com/Documentation/AddOns/released/AWS/S3

"The Generic S3 custom data types input ...

Labels (1)
Tags (3)
0 Karma

mmwilson0
Explorer

Try adding to your input:

parse_csv_with_header=0

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...