- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Can you ignore indexing of a header field on a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you ignore indexing of a header field on a CSV file?
Hi,
I would like to avoid the indexing of a Header field on a CSV file. How can I do that? Can anyone help me?
thanks and regards,
Santosh
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please clarify (perhaps with some sample data) what you want to accomplish? Do you want to ignore some header lines from the CSV file (as the answer by @richgalloway assumes) or do you want to ignore a certain field (so entire column) of the CSV file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Frank,
For Ex:
I want to on-board 'test.csv' file to splunk which has the following columns:
Incident Ticket . Location . Tower . Category . Severity
763537 Bangalore S1 Network issue Urgent
783749 London A Operating System . Normal
Now, while reading this CSV data to Splunk, I would like to ignore field from indexing. Only field values (763537, Bangalore, S1, Network Issue, Urgent) needs to be indexed into Splunk.
After indexing, the event should not contain the header fields whereas these fields should be available on the left side under Interesting Fields only.
I hope this might give you a clarity now. regards, Santosh
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, so you want to interpret the header line as the field names and not ingest it as an event itself. Then the answer from @richgalloway (or something along those lines) should be the solution.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Exactly. Thanks Frank for the prompt response.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you use these settings in your props.conf file, the header line should be interpreted as a list of field names and not indexed.
[mysourcetype]
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER = 0
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have tried updating props with INDEXED_EXTRACTIONS = CSV after indexing happened this is not giving me any results and i still can see header in my events
I have tried/tested in our dev instance and changed the index name to main in inputs.conf and tested then it is working
So my question here is whether this Indexed_extractions = csv doesnt work after the indexing is already done
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, Thanks for the solution. I will check it and reply you back. regards, Santosh
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
