Getting Data In

Importing CSV field into an existing index field


I've recently installed an add on in my dev instance which created various fields, including user and NormalizedUser. I have a one-time csv file that has a list of users I need imported into one or both of those existing fields. Is this possible? It doesn't seem to do so and I prefer not to have to search against multiple fields (I'd like to do a query against the Add On's index for user or NormalizedUser to only retrieve the entire list of users or NormalizedUser's.)  Currently it seems to input the csv data into some other field name and I don't even know where it's grabbing that field name from.  The field header on the csv column is NormalizedUser

Any help appreciated

Labels (3)
0 Karma


Once your data has been indexed in Splunk it cannot be modified. Your only option would be to delete the existing data and re-ingest using your update schema.

When ingesting CSV files the field names are assigned based on the first line of the file. Basically this should be the column header name as if you were viewing it in Excel. If that line doesn't exist, or isn't consistent you will get unpredictable results in your index.

If you know ahead of time the header won't exist you can assign the field names in your sourcetype in props.conf. But any changes to the sourcetype will only affect new data coming in. Once the data has been indexed it's permanent.

An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...