I tried providing a csv file location in inputs.conf,
[monitor:///path/to/*.csv.gz]
source = testcsv
sourcetype = testcsvlog
and in props.conf
FIELD_DELIMITER=,
RAW data:
"Field1", "Field2","Field3" ,"Field4"
"value1","value2","value3","value4"
But I am unable to view the fields based on headers. Please help.
Hello @jkponnuri,
I am a tech writer at Splunk and I'd like to help with your question. I wanted to suggest a couple of documentation topics as a start.
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Aboutindexedfieldextraction
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime
Hope this helps! Let me know, either way, and we can continue troubleshooting.
All best,
@frobinson_splunk
I just tested a gzip'd .csv file, and got proper extraction with the following inputs stanza:
[monitor:///tmp/*.gz]
index = main
sourcetype = csv
the sourcetype as csv should do it.
Hi, for normal csv file it's working fine. But filename.csv.gz it didn't work as expected. Please let me know for. Gz file extension any other process we need to follow?
Thanks.
Somehow managed to work by using sourcetype=csv-2
It did worked as expected. Thanks..
Great, glad you got that working!
Hi,
Sorry for delay reply. I tried this but csv files are working fine. But not csv.gz files. I am.unable to get field name based on headers.
Thanks,
Hi, Thanks for the answer. I tried now. Hope it should work. I will update you once it work. Thanks again.
Great--do let me know how it turns out!
All best,
@frobinson_splunk
Hello @jkponnuri,
I am a tech writer at Splunk and I'd like to help with your question. I wanted to suggest a couple of documentation topics as a start.
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Aboutindexedfieldextraction
http://docs.splunk.com/Documentation/Splunk/6.2.4/Data/Extractfieldsfromfileheadersatindextime
Hope this helps! Let me know, either way, and we can continue troubleshooting.
All best,
@frobinson_splunk