Splunk Search

Uploading a CSV with multiline field value

Communicator

hi,

I want to do a lookup to a CSV file which is having multi line field value when i upload a file for lookup its givng me error as file is in binary format.
How can i upload such CSV or is there any other way to do lookup for fields with multi line value?

Thanks and regards

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

I created a lookup like this (note the quotes):


field,value
"key","This is a multi-line string
that lives in a CSV file."

It worked just fine, but the search results (| inputlookup foo.csv) ended up eliding the newlines, so the "value" side came out as just a long string.

Could it be that your multi-line values are not quoted?

0 Karma

Splunk Employee
Splunk Employee

There is no problem with the structure, so I wonder if there are hidden binary characters that are inhibiting the upload. you might want to see if you text editor can reveal hidden characters so you can clean them up if need be.
The exact error will help as well.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

Communicator

hi,
yea its a comma delimited file and i am able to edit in text editor.
Sample entry in file

message
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible

solution
try below options, set command timeout parameter to 0. It will execute till the end. By default it will timeout in 30 secs.
sqlComm.CommandTimeout = 0

where "mesasge" and "solution" are two filed in my csv

0 Karma

Splunk Employee
Splunk Employee

It isn't completely clear from what you've said, but is the file a comma delimited text file or is it something else? Does it contain binary characters? Can you open it and edit it in a text editor?

It would also help to provide a sample of the file here so we are clear on what you mean by multiline exactly.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!