- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to extract fields from CSV
Naga
Engager
09-30-2021
05:04 AM
I have a CSV file for ingestion like this. This needs to be monitored via inputs. I dont want to use INDEXED_EXTRACTION= CSV here. Without this I am able to get the feed in successfully. But not able to extract the fields I wanted
File sample
"NAME","AGE","GENDER"
"John","32","MALE"
"ROSE","23","FEMALE"
#props
[mysourcetype]
FIELD_DELIMITER = ,
FIELD_NAMES="NAME","AGE","GENDER"
HEADER_FIELD_LINE_NUMBER=1
HEADER_FIELD_DELIMITER = ,
FIELD_QUOTE = "
HEADER_FIELD_QUOTE = "
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
No luck. Any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
09-30-2021
08:27 AM
If you're trying to do search time field extraction for CSV fields, give solution from this post a try:
https://community.splunk.com/t5/Getting-Data-In/splunk-field-extraction-csv/m-p/29894
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
isoutamo

SplunkTrust
09-30-2021
05:30 AM
You should drop FIELD_NAMES as you have already those names in your CSV file and pointed those with HEADER_FIELD_LINE_NUMBER
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Naga
Engager
09-30-2021
08:17 AM
