Getting Data In

How to extract fields from CSV

Naga
Engager

I have a CSV file for ingestion like this. This needs to be monitored via inputs. I dont want to use INDEXED_EXTRACTION= CSV here. Without this I am able to get the feed in successfully. But not able to extract the fields I wanted

File sample

"NAME","AGE","GENDER"

"John","32","MALE"

"ROSE","23","FEMALE"

#props

[mysourcetype]
FIELD_DELIMITER = ,
FIELD_NAMES="NAME","AGE","GENDER"

HEADER_FIELD_LINE_NUMBER=1
HEADER_FIELD_DELIMITER = ,
FIELD_QUOTE = "
HEADER_FIELD_QUOTE = "
DATETIME_CONFIG = CURRENT
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true

No luck. Any ideas?

Labels (3)
0 Karma

somesoni2
Revered Legend

If you're trying to do search time field extraction for CSV fields, give solution from this post a try:

https://community.splunk.com/t5/Getting-Data-In/splunk-field-extraction-csv/m-p/29894

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You should drop FIELD_NAMES as you have already those names in your CSV file and pointed those with HEADER_FIELD_LINE_NUMBER
0 Karma

Naga
Engager

Thank you @isoutamo . I tried the same Removed FIELD_NAMES And tried as well. But no luck 😞

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...