Trying to add a CSV file via Data Inputs in Splunk Web, why am I unable to preview data after entering the file and sourcetype?

[tmaltizo]

I'm trying to add a .csv file via Data Inputs. Here are the steps I'm taking for this (v6.4):

1. Settings > Data Inputs > Files & Directories > New
2. Select the .csv file and the option to "Continuously Monitor", Next>
3. Sourcetype: csv (default)
4. Timestamp: Current Time
5. Field Delimiter: Comma (,)
6. Quote character: Double-quote (")
7. Field names: Line... , Field names on line number: 1
8. Advanced: Kept all defaults
9. Next>>>>>>>>>>>NO PREVIEW OF DATA.
10. Input Settings: App Context-Search&Reporting
11. Input Settings: Host-Constant Value,
12. Input Settings: Index-siam

Ran the following search:

source="C:\\Users\\User1\\Downloads\\SearchReport.csv" host="USABCD123456" index="siam" sourcetype="csv"

NO DATA, but the file is listed under "Files & Directories"

Any help is much appreciated!

[sundareshr]

Data Preview does not work on "Continously Monitor". You need to select "One Time", verify your settings, save your sourcetype and before you finalize, go back and change to "Continously Monitor"

[tmaltizo]

Hi @sundareshr. Thanks for responding!

I tried the "Index Once" option, with all other settings as stated above and I'm still not able to preview the data before moving on to configuring the Input Settings.

When I continue to submit the new data input, there are no results returned. Going back to change to "Continuously Monitor", I don't even see my file listed.

Please advise.

[sundareshr]

Check the splunk logs for any errors or warning

 index=_internal sourcetype=splunkd error OR warn

[tmaltizo]

index=_internal.... returns nothing.
Since, I'm doing this from my FREE local Splunk instance, does this matter? It's a simple .csv sample file.