Getting Data In

CSV file not extracting properly when there is empty value for a field

satvika
New Member

Hi there,

I have a CSV file with the following header and values in it. There are some empty values for a field too. The line which has an empty field value isn't extracting correctly.

Ex: Field1  Field2  Field3  Field4  Field5   Field6   Field7  Field8

      abc        123       gfdj       8583   djhcsh  jdcjhd   dcu      jxnchsdi

      dabc      1423   ggfdj     98583  kjdcjhd          nchsdi     sjdkvv

In the example the line 1 is extracting properly, but the line 2 where the field6 is empty isn't extracting properly.

Any help is appreciated. Thanks

My props.conf

[sourcetype]
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER=,
HEADER_FIELD_LINE_NUMBER = 1
SHOULD_LINEMERGE = false

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share the raw form of the CSV (with commas rather than spaces)?

How is line 2 not extracting properly?  What are you getting compared to what you expect to get?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...