Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Use headers as fields for CSV imports on splun...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, i'm using the splunk cloud platform for a school project. When I import my csv files into splunk, it doesn't seem to recognise the headers of my csv as a field. Does anyone know how to get splunk to recognise my headers? thanks for any help
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pelican,
As a quick and dirty solution, you can select "csv" in the "Source type:" drop-down on the Set Source Type page of the Add Data process. This will tell Splunk to read field names from the first line of the file and index subsequent lines using the header fields as indexed field extractions.
After the file is indexed, you can search for it in the default index using:
sourcetype=csv
If you specified a non-default index, add the index to the search:
index=homework sourcetype=csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shoot mine is doing the opposite, I have a CSV with no header row, and it is using the first row of data as a header, how do I make it stop, lol
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @pelican,
As a quick and dirty solution, you can select "csv" in the "Source type:" drop-down on the Set Source Type page of the Add Data process. This will tell Splunk to read field names from the first line of the file and index subsequent lines using the header fields as indexed field extractions.
After the file is indexed, you can search for it in the default index using:
sourcetype=csv
If you specified a non-default index, add the index to the search:
index=homework sourcetype=csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much, I've spent at least 10 hours on this
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
