Getting Data In

parse csv content and header for fields

pduvofmr
Path Finder

Hi @ All,

i´ve got problems to parse the following file / content:

"CreationTime","LastWriteTime","LastAccessTime","Name","Length","Directory"
"25/03/2020 10:27:21","25/03/2020 10:27:36","25/03/2020 10:27:21","01.txt","5","C:\Share"
"25/03/2020 11:12:10","13/12/2019 11:48:07","25/03/2020 11:12:10","splunkforwarder-8.0.1.msi","68755456","C:\Share"
"25/03/2020 10:28:04","25/03/2020 10:28:17","25/03/2020 10:28:04","01.txt","13","C:\Share\A"
"25/03/2020 10:28:04","25/03/2020 10:28:32","25/03/2020 10:28:22","02.txt","12","C:\Share\A"
"25/03/2020 10:28:53","25/03/2020 10:28:53","25/03/2020 10:28:53","Empty.zip","22","C:\Share\B"

my problem is, that splunk dont regognise / use the header infomations and dont split per line.
i tried with probs.conf CSV option, header check, filds delmiter, header delimter, quotes option, field names, etc etc...

All options displays the same result... the header as event and one of the lines (randomly) as event...

Anybody who can help me?

THX - Markus

0 Karma
1 Solution

PavelP
Motivator

Hi Markus,

you can use Settings -> Add Data wizard to get the parsing right. Here are the settings that I got using wizard:
[ your_csv_sourcetype ]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true

you have to put this configuration on universal forwarder or where splunk reads the file, not on indexer or on search head. As mentioned in props.conf:

This setting applies at input time, when data is first read by Splunk software, such as on a forwarder that has configured inputs acquiring the data.

Additionally you have to set KV_MODE=none on SH. Which time field should be used as time source is up to you, use TIMESTAMP_FIELDS for it.

alt text

View solution in original post

PavelP
Motivator

Hi Markus,

you can use Settings -> Add Data wizard to get the parsing right. Here are the settings that I got using wizard:
[ your_csv_sourcetype ]
CHARSET=UTF-8
INDEXED_EXTRACTIONS=csv
KV_MODE=none
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true

you have to put this configuration on universal forwarder or where splunk reads the file, not on indexer or on search head. As mentioned in props.conf:

This setting applies at input time, when data is first read by Splunk software, such as on a forwarder that has configured inputs acquiring the data.

Additionally you have to set KV_MODE=none on SH. Which time field should be used as time source is up to you, use TIMESTAMP_FIELDS for it.

alt text

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...