Corrupt csv header in CSV file , 2 columns with the same name '

[dokaas_2]

I'm seeing errors such as:

   Corrupt csv header in CSV file , 2 columns with the same name '' (col #12 and #8, #12 will be ignored)

but there I can't find the reference to what CSV file that is causing this error.  Does anyone have any guidance on how to find the offending CSV file?

[alferone]

I've never understood why Spunk doesn't just log the offending .csv file.  

[tscroggins]

Hi @dokaas_2,

Hints should be present in either the search or the search log. For example, if the inputlookup or lookup commands are used in the search, the cause may be the file referenced by the lookup. If the error is caused by an automatic lookup, the source lookup should appear in the search log just prior to the error. Here's a contrived example:

05-25-2024 14:06:52.070 INFO  CsvDataProvider [421638 searchOrchestrator] - Reading schema for lookup table='bad_csv_header_lookup', file size=32, modtime=1716659989
05-25-2024 14:06:52.070 WARN  SearchResultsCSVSerializer [421638 searchOrchestrator] - Corrupt csv header in CSV file , 2 columns with the same name 'bar' (col #5 and #1, #5 will be ignored)

Looking at the definition of bad_csv_header_lookup reveals my purposefully malformed bad_csv_header.csv file.

In your error, the column name is empty: ''. If you have access to the Splunk host, you can scan $SPLUNK_HOME for CSV files with an empty column header, which is malformed with or without duplicates:

find /opt/splunk -type f -name "*.csv" -exec sh -c "head -n 1 {} | grep -- ',,' >/dev/null" \; -printf "%p\n"

Some add-ons in Splunkbase ship with malformed CSV lookups files, but the most likely cause is a CSV file without a header row.