Getting Data In

Support CSV files that have no CRLF at end of last line?

wryanthomas
Contributor

In the TA documentation at https://splunk.github.io/splunk-add-on-for-amazon-web-services/S3/ -- it is stated, "Ensure that all files have a carriage return at the end of each file. Otherwise, the last line of the CSV file will not be indexed."  But the CSV standard (https://www.ietf.org/rfc/rfc4180.txt) does not require a CRLF at end of last row.  Can you please remedy this so a standard-compliant CSV file without a final CRLF still works and ingests the final row?  Some source solutions only output CSV files in this way (without final CRLF).

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Mind you this RFC is informational and only aims to document common practices. It's by no means to be a standard.

0 Karma

wryanthomas
Contributor

Thanks.  I see that RFC 4108 specifies the same thing -- that the last line could end with or without a final CRLF:

https://www.loc.gov/preservation/digital/formats/fdd/fdd000323.shtml

In the Notes, General section at the end of the document, "The last record in a file may or may not end with a line break character."

 

0 Karma

wryanthomas
Contributor

Thanks.  I have submitted it as an idea at ideas.splunk.com.  https://ideas.splunk.com/ideas/APPSID-I-944

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you want this kind of feature into this TA, you must ask it from splunk support and/or ideas.splunk.com.
0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...