Splunk Enterprise

How can I configure Splunk to read a csv file from a sourcetype

Path Finder


I have the following .csv file that needs to be captured by Universal Forwarder, but the data is coming in messy. Could you help me how to create a sourcetype so that they are indexed in the order of the first line?


"04/03/2021","SP","Agência","1010","AS","TESTE","Claudio A.","OnHook (01:00:00)","03-2021"
"04/03/2021","","Agência","","Consultor","32323232","Claudio A.","OnHook (10:00:41)","03-2021"


Labels (1)
Tags (1)
0 Karma


Please show an example of the "messy" input.  Also, what do you mean by "in the order of the first line"?  The first line is a header that doesn't specify an order.  Besides, the forwarder always reads files from the first line to the last and there is no way to change that.

If this reply helps you, an upvote would be appreciated.
0 Karma