Getting Data In

Why did Splunk data load skip a field assignment for a column name from a source view?

Explorer

Hello,

I'm having an issue with a .csv file containing data from an Oracle database view that is being extracted nightly and ingested into Splunk. I'm not involved in the Splunk configuration side of things at my job. I requested the data be sent to Splunk so that I can integrate it into various dashboards I'm developing.

The issue is that Splunk has shifted the field names one column to the right, so to speak. Say the column names from the source view are A, B, C, D, E, F, G, H, ......, Y, Z.

A, B, C, and D have corresponding fields in Splunk and they contain the appropriate values. However, starting with column E, the corresponding field in Splunk that contains the values for the E column is named F instead. This trend continues (Splunk field that contains values from column F in the source view is named for column G, etc...) until the penultimate field, which is named for the final column from the source view (Z) but contains values from column Y. Then, there is a field named EXTRAFIELD21. This field contains the values for column Z in the source view.

Apologies for the description, I'm finding the issue difficult to articulate. Basically, EXTRAFIELD21 should be named E instead and field values should be 'shifted' to the right by one starting with that field.

Any idea what may be causing this? All commas and equals symbols have been removed from the view. There is nothing but letters and dashes in the view column E. Thanks in advance for any insight!

0 Karma

Esteemed Legend

This can happen if you are not properly protecting commas inside of your events with double-quotes. For example, if you have this, then it will work:

A,B,C,D,E,F,
"A","B","C","D,1","E","F"

But if your data, particularly your value for field D which has a comma in it, you will have this:

A,B,C,D,E,F,
A,B,C,D,1,E,F

Then fields D on out will be wrong.

0 Karma

SplunkTrust
SplunkTrust

Look closely at the values for field D. It's possible Splunk is interpreting them as two separate values (D and E).

---
If this reply helps you, an upvote would be appreciated.
0 Karma