parse csv content and header for fields

[pduvofmr]

Hi @ All,

i´ve got problems to parse the following file / content:

"CreationTime","LastWriteTime","LastAccessTime","Name","Length","Directory"
"25/03/2020 10:27:21","25/03/2020 10:27:36","25/03/2020 10:27:21","01.txt","5","C:\Share"
"25/03/2020 11:12:10","13/12/2019 11:48:07","25/03/2020 11:12:10","splunkforwarder-8.0.1.msi","68755456","C:\Share"
"25/03/2020 10:28:04","25/03/2020 10:28:17","25/03/2020 10:28:04","01.txt","13","C:\Share\A"
"25/03/2020 10:28:04","25/03/2020 10:28:32","25/03/2020 10:28:22","02.txt","12","C:\Share\A"
"25/03/2020 10:28:53","25/03/2020 10:28:53","25/03/2020 10:28:53","Empty.zip","22","C:\Share\B"

my problem is, that splunk dont regognise / use the header infomations and dont split per line.
i tried with probs.conf CSV option, header check, filds delmiter, header delimter, quotes option, field names, etc etc...

All options displays the same result... the header as event and one of the lines (randomly) as event...

Anybody who can help me?

THX - Markus

[PavelP · Accepted solution]

Hi Markus,

you can use Settings -> Add Data wizard to get the parsing right. Here are the settings that I got using wizard:
[ your_csv_sourcetype ]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true

you have to put this configuration on universal forwarder or where splunk reads the file, not on indexer or on search head. As mentioned in props.conf:

This setting applies at input time, when data is first read by Splunk software, such as on a forwarder that has configured inputs acquiring the data.

Additionally you have to set KV_MODE=none on SH. Which time field should be used as time source is up to you, use TIMESTAMP_FIELDS for it.