Getting Data In

csv with headers processing

a212830
Champion

Hi,

Trying (still) to get delimted files properly handled by Splunk, with automatic failed extraction. I followed the directions on this link - http://answers.splunk.com/answers/29418/step-by-step-adding-a-new-csv-datasource - which seem very straighfoward. One difference is that my files are pipe (|) delimited. When I start splunk, I get a bunch of the following:

ossible typo in stanza [snmpinfo-87] in /apps/splunk/splunk/etc/apps/learned/local/props.conf, line 1158: DELIMS = "|"
Possible typo in stanza [snmpinfo-88] in /apps/splunk/splunk/etc/apps/learned/local/props.conf, line 1170: DELIMS = "|"
Possible typo in stanza [snmpinfo-89] in /apps/splunk/splunk/etc/apps/learned/local/props.conf, line 1182: DELIMS = "|"
Possible typo in stanza [snmpinfo-90] in /apps/splunk/splunk/etc/apps/learned/local/props.conf, line 1194: DELIMS = "|"
Possible typo in stanza [snmpinfo-91] in /apps/splunk/splunk/etc/apps/learned/local/props.conf, line 1206: DELIMS = "|"
WARN IniFile - /apps/splunk/splunk/etc/system/local/props.conf, line 10: Cannot parse into key-value pair: REPORT-mysource snmp_csv

Does anyone have any suggestions? This is really frustrating me. My files are such:

inputs:
[monitor:///usr/local/nsmutils/export/current/]
index=perfstats
sourcetype=snmpinfo
followTail = 0
blacklist = .csv
crcSalt =
initCrcLength = 500

props:
[source::snmpinfo]
REPORT-mysource snmp_csv
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = FALSE
KV_MODE = none
CHECK_FOR_HEADER = TRUE
NO_BINARY_CHECK = 1
TIME_FORMAT = %s
SHOULD_LINEMERGE = false
TIME_PREFIX = ^"
TZ = US/Eastern

transforms:
[smp_csv]
DELIMS = "|"
FIELDS = "ATime","aItemId","aintMfName","ametric","avalue","amfDisplayName","adevice","acomponentName"

Tags (1)
0 Karma

TobiasBoone
Communicator

I believe needs to be all caps.

0 Karma

Ayn
Legend

Three things:

  1. You have the wrong syntax in props.conf. REPORT-mysource snmp_csv is missing an equals sign - it should be REPORT-mysource = snmp_csv.
  2. You have a typo in transforms.conf - you refer to snmp_csv in props.conf but the transform is called smp_csv.
  3. I think you've confused source with sourcetype. snmpinfo is the sourcetype, not the source, so when you say [source::snmpinfo] in props.conf, this won't match any events and your settings will not be applied no matter how correct they are. Your stanza should read just [snmpinfo] instead.
0 Karma

Ayn
Legend

It definitely can. Those warnings are not from your settings, they are from other config files.

0 Karma

a212830
Champion

Thanks for the help. I made those adjustments, but I'm still getting the same errors. Can splunk handle a pipe as a delimiter?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...