Splunk Enterprise

Corrupt csv header in CSV file , 2 columns with the same name '

dokaas_2
Communicator

I'm seeing errors such as:

   Corrupt csv header in CSV file , 2 columns with the same name '' (col #12 and #8, #12 will be ignored)

but there I can't find the reference to what CSV file that is causing this error.  Does anyone have any guidance on how to find the offending CSV file?

Labels (1)
0 Karma

alferone
Explorer

I've never understood why Spunk doesn't just log the offending .csv file.  

0 Karma

tscroggins
Influencer

Hi @dokaas_2,

Hints should be present in either the search or the search log. For example, if the inputlookup or lookup commands are used in the search, the cause may be the file referenced by the lookup. If the error is caused by an automatic lookup, the source lookup should appear in the search log just prior to the error. Here's a contrived example:

05-25-2024 14:06:52.070 INFO  CsvDataProvider [421638 searchOrchestrator] - Reading schema for lookup table='bad_csv_header_lookup', file size=32, modtime=1716659989
05-25-2024 14:06:52.070 WARN  SearchResultsCSVSerializer [421638 searchOrchestrator] - Corrupt csv header in CSV file , 2 columns with the same name 'bar' (col #5 and #1, #5 will be ignored)

Looking at the definition of bad_csv_header_lookup reveals my purposefully malformed bad_csv_header.csv file.

In your error, the column name is empty: ''. If you have access to the Splunk host, you can scan $SPLUNK_HOME for CSV files with an empty column header, which is malformed with or without duplicates:

find /opt/splunk -type f -name "*.csv" -exec sh -c "head -n 1 {} | grep -- ',,' >/dev/null" \; -printf "%p\n"

Some add-ons in Splunkbase ship with malformed CSV lookups files, but the most likely cause is a CSV file without a header row.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...