Splunk Search

Why is my current configuration not extracting fields when indexing CSV files?

Path Finder

I need help indexing CSV files.
I have read this, http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/Propsconf

My props.conf

[test_csv]
INDEXED_EXTRACTIONS = CSV
FIELD_DELIMITER=,

My inputs.conf on the forwarder

[monitor:///pathtocsvfiles/*.csv]
index = test_index
sourcetype = test_csv
disabled = false

The first line of my CSV file defines the fields and they are comma delimited. Splunk is not using the first line as "interesting fields" once indexed.

Am I missing something?

0 Karma
1 Solution

Path Finder

I got it worked out, I changed the sourcetype to "csv" in the inputs.conf and everything worked as expected. It's kind of a generic sourcetype but Splunk understands it.

View solution in original post

0 Karma

Path Finder

I got it worked out, I changed the sourcetype to "csv" in the inputs.conf and everything worked as expected. It's kind of a generic sourcetype but Splunk understands it.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Have you tried adding HEADER_FIELD_LINE_NUMBER = 1 to props.conf?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

I will give it a shot.

0 Karma

Path Finder

same results, it didn't use the first line for the fields.

0 Karma

SplunkTrust
SplunkTrust

Can you post the first few lines from one of your CSVs?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

For security reasons, I can't post more than the first line.
_id,category,createDate,target,subCategory,actionType,request.userAgent.raw,request.userAgent.browser.name,request.userAgent.browser.fullVersion,request.userAgent.browser.majorVersion,request.userAgent.os.name,request.userAgent.os.manufacturer,request.userAgent.os.type,request.remoteAddress,request.referrer,request.url,actionValues.assetGuid,actionValues.assetTitle,actionValues.assetTypeGuid,actionValues.conceptGuid,actionValues.entityType,actionValues.folderGuid,actionValues.folderTitle,actionValues.formatId,actionValues.isLocalHostUser,actionValues.layout,actionValues.mediaFileGuid,actionValues.mediaFileUrl,actionValues.playedFromLocalHost,actionValues.requestedLanguageId,actionValues.requestedReadingLevelId,actionValues.searchTerm,actionValues.unitGuid,user.siteGuid,user.role,user.isImpersonated,user.isPrivate,user.isStudent,user.userGuid,user.accountGuid,user.sessionId

0 Karma

SplunkTrust
SplunkTrust

Hmm... The _id field is suspicious. Field names with leading underscores tend to be reserved names. Can you change it?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Path Finder

I think I can, maybe put something in the transforms.conf file to change it.

0 Karma