Getting Data In
Highlighted

index empty csv file

Communicator

Hi,

I want to know if i can index a csv file with just the headers without any data in it.

If i search for index=indexname what will i see. and if i try to export the same to a outputfile while will be generated in the output file.

Thanks

Tags (3)
0 Karma
Highlighted

Re: index empty csv file

Path Finder

You can index it, but wont see nothing at search time. I have imported a file with header and without data with Splunk Enterprise 7.0.3.

0 Karma
Highlighted

Re: index empty csv file

Champion

Could you please tell me the requirement to do this?

0 Karma
Highlighted

Re: index empty csv file

Communicator

hi @p_gaurav,

I just want to index a file which has no data in it and just the headers. so that when i search for the index on the seach head i just get the headers shown without any data and the csv generated should have just the headers with no data

0 Karma
Highlighted

Re: index empty csv file

SplunkTrust
SplunkTrust

like @p_gurav mentioned, i am not sure regarding this requirement
also, when indexing a csv file, splunk will avoid the header if there is no values under it.
you can try and use the lookup editor app or use a lookup for this requirement.
hope it helps

0 Karma
Highlighted

Re: index empty csv file

SplunkTrust
SplunkTrust

Assuming you've correct configuration to parse the file data as CSV, and empty-file/just-headers, will not get indexed. Splunk stores raw data with metadata information not just the metadata. Since no results will be shown at search, you won't be able to export or outputfile or outputcsv.

Highlighted

Re: index empty csv file

Communicator

Perfect...

thanks @somesoni2 . You explained really well.

0 Karma
Highlighted

Re: index empty csv file

Contributor

If you want to create lookup file as place holder

you can create a null file by running this in search

|outputlookup yourplaceholderlookupname.csv

0 Karma