Splunk Search

When launching our app, why are we getting "SearchOperator: inputcsv - Encountered 'Inconsistent number of column' errors while reading input"?

TheJagoff
Communicator

Hello,

When I launch an App that was written and that we have here on site, I receive the following error (quite a few times)

WARN  SearchOperator:inputcsv - Encountered 11 'inconsistent number of column' errors while reading input

I have checked all of the CSV tables in this App's lookup directory and they appear to be consistent - meaning they have the same amount of columns relative to the header and the permissions are set to this App.

I also ran the searches separately from the app and there are no errors that come up in the Splunkd.log

Any ideas out there please?

Thank you

0 Karma
1 Solution

TheJagoff
Communicator

I'll answer my own question. I had to isolate which one of the lookup csv files was complaining. After that, there were indeed 11 occurrences where there were commas in the second field thus causing this error. There were well over 1000 lines in this file, so it was a little tedious.

View solution in original post

0 Karma

TheJagoff
Communicator

I'll answer my own question. I had to isolate which one of the lookup csv files was complaining. After that, there were indeed 11 occurrences where there were commas in the second field thus causing this error. There were well over 1000 lines in this file, so it was a little tedious.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...