Getting Data In

FIELD_NAMES for Missing Headers of CSV

emccaslin
Path Finder

I have a comma separated csv file with missing headers. From the props.conf.spec below it has the configuration setting in your props.conf file:


FIELD_NAMES = [ <string>,..., <string>]
* Some CSV and structured files might have missing headers. This attribute tells Splunk to specify the header field names directly.

My problem is I have been unable to get this to work. I push this into the props.conf file and when the logs are indexed I cannot find the field names.

Example csv file looks like this:


1,2,3,4,5
6,7,8,9,10

The headers should be a,b,c,d,e, so what should I set FIELD_NAMES equal to?

FIELD_NAMES = [a,b,c,d,e]
or
FIELD_NAMES = ["a","b","c","d","e"]
or
FIELD_NAMES = [<a>,<b>,<c>,<d>,<e>]
or
FIELD_NAMES = [<"a">,<"b">,<"c">,<"d">,<"e">]

or some other variation? I tried running btool check on my configurations but it doesn't reject what I have tried.

Tags (2)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Here is what you need to have:

Some data in a log file:

place1,41.66164,-87.74477
place2,41.66587,-86.894357
place3,41.72614,-85.97314

inputs.conf - Ensure you set a sourcetype

[monitor:///Users/splunker/Desktop/places.log]
sourcetype=geo

props.conf - Referencing the sourcetype

[geo]
SHOULD_LINEMERGE = false
FIELD_NAMES = location,latitude,longitude

alt text

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Here is what you need to have:

Some data in a log file:

place1,41.66164,-87.74477
place2,41.66587,-86.894357
place3,41.72614,-85.97314

inputs.conf - Ensure you set a sourcetype

[monitor:///Users/splunker/Desktop/places.log]
sourcetype=geo

props.conf - Referencing the sourcetype

[geo]
SHOULD_LINEMERGE = false
FIELD_NAMES = location,latitude,longitude

alt text

dmaislin_splunk
Splunk Employee
Splunk Employee

Please Accept the answer by selecting the check box next to my answer! Thanks!

0 Karma

emccaslin
Path Finder

Thank you!

0 Karma

emccaslin
Path Finder

My data is not enclosed in brackets, and removing the brackets from FIELD_NAMES did not work. Now I am just adding a field extraction and field transformation post-processing to deal with this issue.

0 Karma

lukejadamec
Super Champion

Try removing the brackets:

FIELD_NAMES = "a","b","c","d","e"

Is your data enclosed in brackets?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...