Splunk Search

How do I add a CSV file as an input to show the header as a field name?

akarivaratharaj
Communicator

I am trying to add the below CSV file data into Splunk as an input through the ‘Add Data’ section.
Time, Main_Release, Weekly_Release, Count

01/10/2018, 5.1, 5.1.1, 14
02/10/2018, 5.1, 5.1.2, 20
03/10/2018, 5.2, 5.2.1, 40
04/10/2018, 5.3, 5.3.1, 29

After adding the data, the events which are showing under my index and source type are as follows

Event-1 -> 01/10/2018, 5.1, 5.1.1, 14
Event-2 ->02/10/2018, 5.1, 5.1.2, 20
Event-3 ->03/10/2018, 5.2, 5.2.1, 40
Event-4 ->04/10/2018, 5.3, 5.3.1, 29

But what I am expecting is

Event-1 -> Time=01/10/2018, Main_Release=5.1, Weekly_Release=5.1.1, Count=14
Event-2 -> Time=02/10/2018, Main_Release=5.1, Weekly_Release=5.1.2, Count=20
etc.,

I am expecting the header of the CSV file to be the respective fields for each values. But it is giving me only the values available in the CSV file cell.

Could anyone please help me on this to achieve header as the field name for each events with field values?

0 Karma
1 Solution

493669
Super Champion

If you try with query-

index=<indexname>|table Time, Main_Release, Weekly_Release, Count

it should give you expected output.
you can see below events are extracted with column header as expected.
alt text

View solution in original post

493669
Super Champion

If you try with query-

index=<indexname>|table Time, Main_Release, Weekly_Release, Count

it should give you expected output.
you can see below events are extracted with column header as expected.
alt text

akarivaratharaj
Communicator

Hi @493669 ,

Thanks for your response. In the above method which you mentioned I am able to display my data on dashboard panels.

But just want to know, is there any other way to index the values with their field names in each events while adding the input file itself.

Instead of showing the below:
Event-1 -> 01/10/2018, 5.1, 5.1.1, 14
Event-2 ->02/10/2018, 5.1, 5.1.2, 20

Can we get in this way:
Event-1 -> Time=01/10/2018, Main_Release=5.1, Weekly_Release=5.1.1, Count=14
Event-2 -> Time=02/10/2018, Main_Release=5.1, Weekly_Release=5.1.2, Count=20

0 Karma

493669
Super Champion

I don't think Splunk will give in such manner but in similar way you can get in table fashion because in events splunk will show as raw i.e. the events present in csv in same way splunk will show

0 Karma

akarivaratharaj
Communicator

Okay got it. Thankyou

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...