Getting Data In

CSV imports, headers as fields?

mcrawford44
Communicator

All,

I have been following this documentation;
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Extractfieldsfromfileheadersatindextime

No combination of props.conf settings appears to be working. Here is the data template of the file I am attempting to bring in;

Header1|Header2|Header3|Header4    
DataA|DataB|DataC|DataD

My assumed props.conf;

[SourceTypeName]
FIELD_DELIMITER=|
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=false

Any ideas? I can edit the props.conf during the data add "wizard" and it updates the local conf file appropriately, however each event is still shown as a single line without field information;

Can't post images so replace the 'xx' with 'tt'; hxxp://i.imgur.com/vAKOJFY.png

1 Solution

ShaneNewman
Motivator
[SourceTypeName]
FIELD_DELIMITER = "|"
CHECK_FOR_HEADER = true
HEADER_MODE = firstline

View solution in original post

ogdin
Splunk Employee
Splunk Employee

You don't want to use CHECK_FOR_HEADER in combination with indexed extractions. CHECK_FOR_HEADER is a deprecated technique we used for search-time field extractions.

In props.conf, use:


FIELD_DELIMITER=|
HEADER_FIELD_DELIMITER=|
INDEXED_EXTRACTIONS=psv

0 Karma

mcrawford44
Communicator

The quotes worked. -_-
Thanks!

0 Karma

ShaneNewman
Motivator
[SourceTypeName]
FIELD_DELIMITER = "|"
CHECK_FOR_HEADER = true
HEADER_MODE = firstline

mcrawford44
Communicator

The quotes worked. -_-
Thanks!

0 Karma

lukejadamec
Super Champion

Have you tried quotes around the pipe? "|"

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...