Getting Data In

How do I add fields to incoming data?

raghu0463
Explorer

Hi,

I'm trying to load a CSV file using the universal forwarder, and there are no headers in the CSV file. How can I give column names to those values in the file? Can I do that at props.conf? I don't want to use the extract field option...

eg : file.csv as below values

1,2,3,4,5
6,7,8,9,10
11,12,13,14,15

0 Karma

nickhills
Ultra Champion

if you want to define the stanza by the source file name you can use:

[source::/path/to/file.csv]
FIELD_NAMES = A,B,C,D,E
If my comment helps, please give it a thumbs up!
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@raghu0463 ,

You can configure them in props.conf

[your sourcetype for csv file]
FIELD_NAMES =field1,field2,.....

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Structured_Data_Header_Extractio...

Happy Splunking!
0 Karma

raghu0463
Explorer

how does it identifies from which source and file ? if I just mention only csv

i.e
[csv]
FIELD_NAMES = A,B,C,D,E

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@raghu0463 , thats what meant by [your sourcetype for csv file]. You need to set a sourcetype for your file based on the content. Or you can use source/host in the SPEC

Common SPEC

[<spec>]
* This stanza enables properties for a given <spec>.
* A props.conf file can contain multiple stanzas for any number of
  different <spec>.
* Follow this stanza name with any number of the following setting/value
  pairs, as appropriate for what you want to do.
* If you do not set an setting for a given <spec>, the default is used.

<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
                 event.
3. source::<source>, where <source> is the source, or source-matching
                     pattern, for an event.
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...