Getting Data In

AWS S3 Input- Ingest .csv files that are not actually csv formatted- Is there a way to turn off CSV parsing ability?

ehudb
Contributor

We have a new Splunk Cloud environment

We are using AWS TA Add On to ingest files from S3

The files have extension of ".csv" but they are not really CSV, they are TSV (tab separated values).

The Add-On has built-in functionality to inspect CSV files and tried to convert them to json, therefore it fails to ingest them correctly.

Is there any way to turn-off the CSV parsing ability of the S3 input?

Source:
https://docs.splunk.com/Documentation/AddOns/released/AWS/S3

"The Generic S3 custom data types input ...

Labels (1)
Tags (3)
0 Karma

mmwilson0
Explorer

Try adding to your input:

parse_csv_with_header=0

 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...