Getting Data In

When I use the inputcsv command with my data, I see an eventcount, but the events are blank. Why is this?

ycalpu
New Member

Hi all, when i do an inputcsv command, I see the data in the file I put on the splunk server. Since I want to see them as events I query the following:
| inputcsv filename.csv (I see all the data, 7603 counted)
| inputcsv start=1 events=yes filename.csv (I get the 7602 count, but showing all blank)

Any ideas why its showing blanks?

Tags (2)
0 Karma

jrodman
Splunk Employee
Splunk Employee

Events in the event viewer will generally be blank unless they include a _raw field. Your sv file probably does not have a field (or column) called _raw, which is the text of the event.

0 Karma

ycalpu
New Member

jrodman, how do you designate the _raw field?

Y

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...