Hello,
I'm having an issue with a .csv file containing data from an Oracle database view that is being extracted nightly and ingested into Splunk. I'm not involved in the Splunk configuration side of things at my job. I requested the data be sent to Splunk so that I can integrate it into various dashboards I'm developing.
The issue is that Splunk has shifted the field names one column to the right, so to speak. Say the column names from the source view are A, B, C, D, E, F, G, H, ......, Y, Z.
A, B, C, and D have corresponding fields in Splunk and they contain the appropriate values. However, starting with column E, the corresponding field in Splunk that contains the values for the E column is named F instead. This trend continues (Splunk field that contains values from column F in the source view is named for column G, etc...) until the penultimate field, which is named for the final column from the source view (Z) but contains values from column Y. Then, there is a field named EXTRA_FIELD_21. This field contains the values for column Z in the source view.
Apologies for the description, I'm finding the issue difficult to articulate. Basically, EXTRA_FIELD_21 should be named E instead and field values should be 'shifted' to the right by one starting with that field.
Any idea what may be causing this? All commas and equals symbols have been removed from the view. There is nothing but letters and dashes in the view column E. Thanks in advance for any insight!
