Splunk Search

What does SearchResults "Corrupt csv header" mean?

Super Champion

Does anyone know what this message means?

06-14-2010 15:45:14.859 WARN SearchResults - Corrupt csv header, 2 columns with the same name 'ipstr' (col #6 and #2, #6 will be ignored)

0 Karma
1 Solution

Super Champion

Think I found the problem. A had a saved search with the following fields search command:

... | fields + user,flags,ipstr,pid,logontime,ipstr,rip,dur_mins,eventcount

Looks like I accidentally listed the "ipstr" field twice. Whoops.

View solution in original post

Super Champion

Think I found the problem. A had a saved search with the following fields search command:

... | fields + user,flags,ipstr,pid,logontime,ipstr,rip,dur_mins,eventcount

Looks like I accidentally listed the "ipstr" field twice. Whoops.

View solution in original post