Getting Data In

csv headers are not getting listed

Gowthamdevaraj
New Member

Hello,

I have clonned the CSV source type in Splunk and created a new CSV sourcetype as Alpha_csv and configured to monitor the csv files.

I have created a deployment apps and configured inputs.conf in deployment app.

All my csv files are not getting monitored but no as per header values. (no csv headers are getting listed)

csv sourcetype is set to auto, comma separated csv.

Can anyone help on this?

Thanks

Tags (2)
0 Karma
1 Solution

manjunathmeti
Champion

Along with inputs.conf you also need to copy settings for Alpha_csv in props.conf in deployment app and deploy it to forwarder server.

View solution in original post

0 Karma

manjunathmeti
Champion

Along with inputs.conf you also need to copy settings for Alpha_csv in props.conf in deployment app and deploy it to forwarder server.

0 Karma

PavelP
Motivator

Hello @Gowthamdevaraj ,
if I understand you correctly the file get monitored correctly, but you cannot see the first line of the logs with header names? This is how indexed_extraction for CSV works - your fields are get parsed and mapped to the right field taken from the header line and the header line get removed. You can access any parsed field by using the field name.

Here is more info about indexed extraction: https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Extractfieldsfromfileswithstructureddata

Have it worked before you cloned the source type?

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...