How can I extract fields based on headers from a CSV file in .gz format?

[jkponnuri]

I tried providing a csv file location in inputs.conf,

[monitor:///path/to/*.csv.gz]
source = testcsv
sourcetype = testcsvlog

and in props.conf

FIELD_DELIMITER=,

RAW data:

"Field1", "Field2","Field3" ,"Field4"
"value1","value2","value3","value4"

But I am unable to view the fields based on headers. Please help.

[jnussbaum_splun]

I just tested a gzip'd .csv file, and got proper extraction with the following inputs stanza:
[monitor:///tmp/*.gz]
index = main
sourcetype = csv

the sourcetype as csv should do it.

[jkponnuri]

Hi, for normal csv file it's working fine. But filename.csv.gz it didn't work as expected. Please let me know for. Gz file extension any other process we need to follow?
Thanks.

[jkponnuri]

Somehow managed to work by using sourcetype=csv-2
It did worked as expected. Thanks..

[frobinson_splun]

Great, glad you got that working!

[jkponnuri]

Hi,

Sorry for delay reply. I tried this but csv files are working fine. But not csv.gz files. I am.unable to get field name based on headers.

Thanks,

[jkponnuri]

Hi, Thanks for the answer. I tried now. Hope it should work. I will update you once it work. Thanks again.

[frobinson_splun]

Great--do let me know how it turns out!
All best,
@frobinson_splunk

[frobinson_splun · Accepted solution]

Hello @jkponnuri,
I am a tech writer at Splunk and I'd like to help with your question. I wanted to suggest a couple of documentation topics as a start.
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Aboutindexedfieldextraction

http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime

Hope this helps! Let me know, either way, and we can continue troubleshooting.

All best,
@frobinson_splunk