Getting Data In

How do I add fields to incoming data?

raghu0463
Explorer

Hi,

I'm trying to load a CSV file using the universal forwarder, and there are no headers in the CSV file. How can I give column names to those values in the file? Can I do that at props.conf? I don't want to use the extract field option...

eg : file.csv as below values

1,2,3,4,5
6,7,8,9,10
11,12,13,14,15

0 Karma

nickhills
Ultra Champion

if you want to define the stanza by the source file name you can use:

[source::/path/to/file.csv]
FIELD_NAMES = A,B,C,D,E
If my comment helps, please give it a thumbs up!
0 Karma

renjith_nair
Legend

@raghu0463 ,

You can configure them in props.conf

[your sourcetype for csv file]
FIELD_NAMES =field1,field2,.....

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extractio...

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

raghu0463
Explorer

how does it identifies from which source and file ? if I just mention only csv

i.e
[csv]
FIELD_NAMES = A,B,C,D,E

0 Karma

renjith_nair
Legend

@raghu0463 , thats what meant by [your sourcetype for csv file]. You need to set a sourcetype for your file based on the content. Or you can use source/host in the SPEC

Common SPEC

[<spec>]
* This stanza enables properties for a given <spec>.
* A props.conf file can contain multiple stanzas for any number of
  different <spec>.
* Follow this stanza name with any number of the following setting/value
  pairs, as appropriate for what you want to do.
* If you do not set an setting for a given <spec>, the default is used.

<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
                 event.
3. source::<source>, where <source> is the source, or source-matching
                     pattern, for an event.
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...