Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- What is the proper way to load a CSV File ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a CSV file which has a header. I want to load this in SPLUNK and want to perform searches using different fields. The file looks like :
TimeStamp, IPAddress, UserName, URL
2013-11-21 16:67:36,221.78.127.76,JADE,www.google.com
2013-10-22 12:55:37,341.78.125.77,JADE,www.rediff.com
2013-09-11 10:21:40,121.78.127.78,JADE,www.youtube.com
2013-08-24 07:11:25,121.78.128.80,JADE,www.ndtv.com
I tried to load it through the UI through : Add Data --> A file or directory of files --> Browsing for the file. Applied the source type CSV. But it is not recognizing the headers or the fields.
What is the proper way to do this ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Extract the fields manually after indexing the file using Fields Extractions. Or you can edit props.conf and transform.conf files.
props.conf
[myfile]
KV_MODE = none
SHOULD_LINEMERGE = false
REPORT-Myfile = Myfile_extractions
transforms.conf
[Myfile_extractions]
DELIM=","
FIELDS=TimeStamp,IPAddress,UserName,URL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Extract the fields manually after indexing the file using Fields Extractions. Or you can edit props.conf and transform.conf files.
props.conf
[myfile]
KV_MODE = none
SHOULD_LINEMERGE = false
REPORT-Myfile = Myfile_extractions
transforms.conf
[Myfile_extractions]
DELIM=","
FIELDS=TimeStamp,IPAddress,UserName,URL
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much. Let me give a try
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$SPLUNK_HOME/etc/apps/YOURAPPS/default , it depend on your installation, by default it's /opt/splunk/etc/apps/YOURAPPS/default
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks royimad for the quick help. I am a new bee in SPLUNK. I can see lot of props.conf, transforms.conf in locations like system, legacy, apps etc. Which one I need to edit ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
