Splunk Search

PROPS Configuration for csv without Header Source files

SplunkDash
Motivator

Hello,

I have issues to write PROPS configuration file for following csv file (please see screenshot below for sample data) with No Header on it. Five columns showed in the screenshot are all values. Value of First Column also included below for better visibility.  Any help will be highly appreciated. Thank you so much.

Screenshot

malekmo_1-1631204934444.png

 

Value of First Column

sma2aa_L_0__20210906-194605_16305.html@^@^2020-09-10@^@^04:51:43@^@^sma2aa@^@^insert into "nTABLE_MIGRATION_INFO_current"( "user_name"

 

[csv]

SHOULD_LINEMERGE=FALSE

TIME_PREFIX=?

TIME_FORMAT=?

TIMESTAMP_FIELDS=?

HEADER_FIELD_LINE_NUMBER=?

INDEXED_EXTRACTIONS=csv

 

Labels (2)
Tags (1)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

OK, this should work in props.conf on your UF:

 

[mySourcetypeNameDontUseCSV]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
INDEXED_EXTRACTIONS=csv
FIELD_NAMES=SQLFIELD,Field1,Field2,Field3,Field4
TIME_PREFIX=@\^@\^
TIME_FORMAT=%Y-%m%d@^@^%H:%M:%S

 

Change the sourcetype name such that it matches what you set in inputs.conf for the monitor stanza. Again, make it a descriptive name rather than generic "csv", depending on what type of log data this is (e.g. sql:querylog or somesuch). Always good to be explicit and descriptive.

Docs for timestamp recognition

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Couple of questions:

- Where is this csv file picked up from, i.e. is it read by a UF?

- What field names do you expect to use?

- Which part of the first column do you want to be used as the event timestamp (there are multiple TS values)?

0 Karma

SplunkDash
Motivator

Thank you so much, appreciated your support.

Here are the answers of your questions

- Where is this csv file picked up from, i.e. is it read by a UF? Yes by UF

- What field names do you expect to use? SQLFIELD, Field1, Field2, Field3, Field4  

- Which part of the first column do you want to be used as the event timestamp (there are multiple TS values)? Highligter as Bold below (After  html@^@^)

sma2aa_L_0__20210906-194605_16305.html@^@^2020-09-10@^@^04:51:43@^@^sma2aa@^@^insert into "nTABLE_MIGRATION_INFO_current"( "user_name"

 

Thank you again.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

OK, this should work in props.conf on your UF:

 

[mySourcetypeNameDontUseCSV]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
INDEXED_EXTRACTIONS=csv
FIELD_NAMES=SQLFIELD,Field1,Field2,Field3,Field4
TIME_PREFIX=@\^@\^
TIME_FORMAT=%Y-%m%d@^@^%H:%M:%S

 

Change the sourcetype name such that it matches what you set in inputs.conf for the monitor stanza. Again, make it a descriptive name rather than generic "csv", depending on what type of log data this is (e.g. sql:querylog or somesuch). Always good to be explicit and descriptive.

Docs for timestamp recognition

s2_splunk
Splunk Employee
Splunk Employee

Assuming it's the first date/time value in the event you want to use as _time,  and we just name fields according to your column names, this should work:

 

[mySourcetypeNameDontUseCSV]
FIELD_NAMES = A,B,C,D,E
INDEXED_EXTRACTIONS = csv
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false

 

If this file is read by a UF, this props.conf entry must be placed on the UF itself, since you intend to use indexed extractions.

If you want a different part of the event for the timestamp, or if you just want to use index time, you'll need a couple more things.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...