Splunk Search

How can I extract fields based on headers from a CSV file in .gz format?

Explorer

I tried providing a csv file location in inputs.conf,

[monitor:///path/to/*.csv.gz]
source = testcsv
sourcetype = testcsvlog

and in props.conf

FIELD_DELIMITER=,

RAW data:

"Field1", "Field2","Field3" ,"Field4"
"value1","value2","value3","value4"

But I am unable to view the fields based on headers. Please help.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hello @jkponnuri,
I am a tech writer at Splunk and I'd like to help with your question. I wanted to suggest a couple of documentation topics as a start.
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Aboutindexedfieldextraction

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime

Hope this helps! Let me know, either way, and we can continue troubleshooting.

All best,
@frobinson_splunk

View solution in original post

Splunk Employee
Splunk Employee

I just tested a gzip'd .csv file, and got proper extraction with the following inputs stanza:
[monitor:///tmp/*.gz]
index = main
sourcetype = csv

the sourcetype as csv should do it.

Explorer

Hi, for normal csv file it's working fine. But filename.csv.gz it didn't work as expected. Please let me know for. Gz file extension any other process we need to follow?
Thanks.

0 Karma

Explorer

Somehow managed to work by using sourcetype=csv-2
It did worked as expected. Thanks..

0 Karma

Splunk Employee
Splunk Employee

Great, glad you got that working!

0 Karma

Explorer

Hi,

Sorry for delay reply. I tried this but csv files are working fine. But not csv.gz files. I am.unable to get field name based on headers.

Thanks,

0 Karma

Explorer

Hi, Thanks for the answer. I tried now. Hope it should work. I will update you once it work. Thanks again.

0 Karma

Splunk Employee
Splunk Employee

Great--do let me know how it turns out!
All best,
@frobinson_splunk

0 Karma

Splunk Employee
Splunk Employee

Hello @jkponnuri,
I am a tech writer at Splunk and I'd like to help with your question. I wanted to suggest a couple of documentation topics as a start.
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Aboutindexedfieldextraction

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime

Hope this helps! Let me know, either way, and we can continue troubleshooting.

All best,
@frobinson_splunk

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!