Splunk Search

How do I add a CSV file as an input to show the header as a field name?

akarivaratharaj
Communicator

I am trying to add the below CSV file data into Splunk as an input through the ‘Add Data’ section.
Time, Main_Release, Weekly_Release, Count

01/10/2018, 5.1, 5.1.1, 14
02/10/2018, 5.1, 5.1.2, 20
03/10/2018, 5.2, 5.2.1, 40
04/10/2018, 5.3, 5.3.1, 29

After adding the data, the events which are showing under my index and source type are as follows

Event-1 -> 01/10/2018, 5.1, 5.1.1, 14
Event-2 ->02/10/2018, 5.1, 5.1.2, 20
Event-3 ->03/10/2018, 5.2, 5.2.1, 40
Event-4 ->04/10/2018, 5.3, 5.3.1, 29

But what I am expecting is

Event-1 -> Time=01/10/2018, Main_Release=5.1, Weekly_Release=5.1.1, Count=14
Event-2 -> Time=02/10/2018, Main_Release=5.1, Weekly_Release=5.1.2, Count=20
etc.,

I am expecting the header of the CSV file to be the respective fields for each values. But it is giving me only the values available in the CSV file cell.

Could anyone please help me on this to achieve header as the field name for each events with field values?

0 Karma
1 Solution

493669
Super Champion

If you try with query-

index=<indexname>|table Time, Main_Release, Weekly_Release, Count

it should give you expected output.
you can see below events are extracted with column header as expected.
alt text

View solution in original post

493669
Super Champion

If you try with query-

index=<indexname>|table Time, Main_Release, Weekly_Release, Count

it should give you expected output.
you can see below events are extracted with column header as expected.
alt text

akarivaratharaj
Communicator

Hi @493669 ,

Thanks for your response. In the above method which you mentioned I am able to display my data on dashboard panels.

But just want to know, is there any other way to index the values with their field names in each events while adding the input file itself.

Instead of showing the below:
Event-1 -> 01/10/2018, 5.1, 5.1.1, 14
Event-2 ->02/10/2018, 5.1, 5.1.2, 20

Can we get in this way:
Event-1 -> Time=01/10/2018, Main_Release=5.1, Weekly_Release=5.1.1, Count=14
Event-2 -> Time=02/10/2018, Main_Release=5.1, Weekly_Release=5.1.2, Count=20

0 Karma

493669
Super Champion

I don't think Splunk will give in such manner but in similar way you can get in table fashion because in events splunk will show as raw i.e. the events present in csv in same way splunk will show

0 Karma

akarivaratharaj
Communicator

Okay got it. Thankyou

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...