Security

How to use inputcsv command

sarmahari
New Member

I have installed Splunk Enterprise version 8.0.4 on an Ubuntu IBM cloud Server with default port(8000). I can access Splunk from my Laptop's Chrome / Edge browsers. I uploaded an CSV from browser as admin and could search. I have two doubts in this regard
1. How to load an CSV file from Linux command prompt? I went through documentation provided online. What I did not understand was, what is "|" symbol before invoking inputcsv command? Is it some Splunk shell kind of stuff? Is it CLI ? or something
2. I created an user from admin GUI and gave role of "user". Can I upload a CSV by logging in as this user? As per documentation, "user" role should be able to input a file, However, I did not find "Add Data" option on GUI for this user.

Any help is greatly appreciated

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
  1. inputcsv is a generating command, which means it must be preceded by the | character even when it's the first command in a query. The leading | tells Splunk to not add the implicit "search" command.

2, By default, the user role cannot add data. Where did you see the documentation about users and files?

---
If this reply helps you, Karma would be appreciated.
0 Karma

sarmahari
New Member
  1. Regarding inputcsv, where should this command be issued? If I directly type |inputcsv getting error as "-bash: syntax error near unexpected token `|'". Should I issue in some Splunk shell or CLI or where. Sorry for asking trivial question, but went thro' lot of examples, did not find any answers
  2. https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/Admin/UserAccounts at this URL Search for "input_file"
0 Karma

richgalloway
SplunkTrust
SplunkTrust
  1. What is the full command you are trying to enter and where did you find it?
  2. The input_file capability "Lets the user add a file as an input through inputcsv and inputlookup." (emphasis mine) That means they can include a file in their queries. It has nothing to do with Add Data.
---
If this reply helps you, Karma would be appreciated.
0 Karma

sarmahari
New Member

What is inputcsv command used for ? I was thinking an CSV file can be loaded into an index. Is it correct?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

RTM! (https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Inputcsv)
That command reads a file and makes each row an event in the current query. It does not cause data to be indexed. If you want to index a CSV, you can use the collect command after inputcsv.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...