Getting Data In
Highlighted

parse csv content and header for fields

Path Finder

Hi @ All,

i´ve got problems to parse the following file / content:

"CreationTime","LastWriteTime","LastAccessTime","Name","Length","Directory"
"25/03/2020 10:27:21","25/03/2020 10:27:36","25/03/2020 10:27:21","01.txt","5","C:\Share"
"25/03/2020 11:12:10","13/12/2019 11:48:07","25/03/2020 11:12:10","splunkforwarder-8.0.1.msi","68755456","C:\Share"
"25/03/2020 10:28:04","25/03/2020 10:28:17","25/03/2020 10:28:04","01.txt","13","C:\Share\A"
"25/03/2020 10:28:04","25/03/2020 10:28:32","25/03/2020 10:28:22","02.txt","12","C:\Share\A"
"25/03/2020 10:28:53","25/03/2020 10:28:53","25/03/2020 10:28:53","Empty.zip","22","C:\Share\B"

my problem is, that splunk dont regognise / use the header infomations and dont split per line.
i tried with probs.conf CSV option, header check, filds delmiter, header delimter, quotes option, field names, etc etc...

All options displays the same result... the header as event and one of the lines (randomly) as event...

Anybody who can help me?

THX - Markus

0 Karma
Highlighted

Re: parse csv content and header for fields

Motivator

Hi Markus,

you can use Settings -> Add Data wizard to get the parsing right. Here are the settings that I got using wizard:
[ yourcsvsourcetype ]
CHARSET=UTF-8
INDEXEDEXTRACTIONS=csv
KV
MODE=none
SHOULDLINEMERGE=false
disabled=false
pulldown
type=true

you have to put this configuration on universal forwarder or where splunk reads the file, not on indexer or on search head. As mentioned in props.conf:

This setting applies at input time, when data is first read by Splunk software, such as on a forwarder that has configured inputs acquiring the data.

Additionally you have to set KVMODE=none on SH. Which time field should be used as time source is up to you, use TIMESTAMPFIELDS for it.

alt text

View solution in original post

0 Karma