Getting Data In

Why my csv file indexed only the header ?

mah
Builder

Hi, 

I have a script which output a csv file : 

id,name,env,start,end

1234,test,[env]:dev,2020-12-31 18:07,2020-12-31 19:07

The first line is the header and ALL lines in file must be reindexed each time there is a modification (adding or a suppression). 

I have an inputs.conf like this : 

[monitor:///opt/splunk/etc/apps/my_app/bin/my_csv.csv]
index = test
sourcetype = st
disabled = 0
initCrcLength = 3000

I have a props.conf like : 

[st]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true

The indexation is really weird : it actually index only the header :

mah_0-1609348826223.png

Can you help me please ?

Thank a lot.

 

Labels (2)
Tags (1)
0 Karma

FlorianScho
Path Finder

Hi @mah,

did you fixed the problem? Im currently facing the same.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...