Splunk Search

Uploading a CSV with multiline field value

ChhayaV
Communicator

hi,

I want to do a lookup to a CSV file which is having multi line field value when i upload a file for lookup its givng me error as file is in binary format.
How can i upload such CSV or is there any other way to do lookup for fields with multi line value?

Thanks and regards

Tags (3)
0 Karma

sowings
Splunk Employee
Splunk Employee

I created a lookup like this (note the quotes):


field,value
"key","This is a multi-line string
that lives in a CSV file."

It worked just fine, but the search results (| inputlookup foo.csv) ended up eliding the newlines, so the "value" side came out as just a long string.

Could it be that your multi-line values are not quoted?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

There is no problem with the structure, so I wonder if there are hidden binary characters that are inhibiting the upload. you might want to see if you text editor can reveal hidden characters so you can clean them up if need be.
The exact error will help as well.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

ChhayaV
Communicator

hi,
yea its a comma delimited file and i am able to edit in text editor.
Sample entry in file

message
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible

solution
try below options, set command timeout parameter to 0. It will execute till the end. By default it will timeout in 30 secs.
sqlComm.CommandTimeout = 0

where "mesasge" and "solution" are two filed in my csv

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

It isn't completely clear from what you've said, but is the file a comma delimited text file or is it something else? Does it contain binary characters? Can you open it and edit it in a text editor?

It would also help to provide a sample of the file here so we are clear on what you mean by multiline exactly.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...