Splunk Enterprise

Corrupt csv header in CSV file , 2 columns with the same name '

dokaas_2
Communicator

I'm seeing errors such as:

   Corrupt csv header in CSV file , 2 columns with the same name '' (col #12 and #8, #12 will be ignored)

but there I can't find the reference to what CSV file that is causing this error.  Does anyone have any guidance on how to find the offending CSV file?

Labels (1)
0 Karma

alferone
Explorer

I've never understood why Spunk doesn't just log the offending .csv file.  

0 Karma

tscroggins
Influencer

Hi @dokaas_2,

Hints should be present in either the search or the search log. For example, if the inputlookup or lookup commands are used in the search, the cause may be the file referenced by the lookup. If the error is caused by an automatic lookup, the source lookup should appear in the search log just prior to the error. Here's a contrived example:

05-25-2024 14:06:52.070 INFO  CsvDataProvider [421638 searchOrchestrator] - Reading schema for lookup table='bad_csv_header_lookup', file size=32, modtime=1716659989
05-25-2024 14:06:52.070 WARN  SearchResultsCSVSerializer [421638 searchOrchestrator] - Corrupt csv header in CSV file , 2 columns with the same name 'bar' (col #5 and #1, #5 will be ignored)

Looking at the definition of bad_csv_header_lookup reveals my purposefully malformed bad_csv_header.csv file.

In your error, the column name is empty: ''. If you have access to the Splunk host, you can scan $SPLUNK_HOME for CSV files with an empty column header, which is malformed with or without duplicates:

find /opt/splunk -type f -name "*.csv" -exec sh -c "head -n 1 {} | grep -- ',,' >/dev/null" \; -printf "%p\n"

Some add-ons in Splunkbase ship with malformed CSV lookups files, but the most likely cause is a CSV file without a header row.

0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...