Getting Data In

Import csv with header that change column order between different files

edoardo_vicendo
Builder

Hello,

We have to import a csv file that always contains the same amount of column (and corresponding values), but the system that generates it sometimes change the order of the header columns, like this:

 

File01.csv

field01,field02,field03

 

 

 

File02.csv

field03,field01,field02

 

 

Is there any way to ingest the file without using in props.conf this set-up?

INDEXED_EXTRACTIONS=csv

 

The reason is that using the INDEXED_EXTRACTIONS Splunk is adding those fields in the .tsidx and we would like to avoid that.

 

Thanks a lot,

Edoardo

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...