Getting Data In

Selectively ignoring fields in CSV input?


Hey everyone. I am trying to input .csv files. The issue with the files is that the software generating them includes the timestamp numerous times in each line. Here's a rough example:

timestamp,CPU Usage, timestamp, Memory usage, timestamp, temperature, timestamp, license usage, timestamp, SNMP reachability

You get the idea. I don't want to waste space indexing all of the extra timestamp fields. Any advice?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You can use an index time TRANSFORM, or more likely a SEDCMD to modify the data before it goes into the index:

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...