Splunk Enterprise

How can I configure Splunk to read a csv file from a sourcetype

Path Finder


I have the following .csv file that needs to be captured by Universal Forwarder, but the data is coming in messy. Could you help me how to create a sourcetype so that they are indexed in the order of the first line?


"04/03/2021","SP","Agência","1010","AS","TESTE","Claudio A.","OnHook (01:00:00)","03-2021"
"04/03/2021","","Agência","","Consultor","32323232","Claudio A.","OnHook (10:00:41)","03-2021"


Labels (1)
Tags (1)
0 Karma


Please show an example of the "messy" input.  Also, what do you mean by "in the order of the first line"?  The first line is a header that doesn't specify an order.  Besides, the forwarder always reads files from the first line to the last and there is no way to change that.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...