Splunk Search

how to extract field from csv raw data

ravir_jbp
Explorer

below csv file getting generated which is ingested into splunk. These are the file counts created date wise on different folders. My rex command does not pickup the date, filepath and count. Please help how we can extract these field from below csv raw data.

 

"Date","Folder","FileCount"
"11-07-2023","E:\Intra\I\IE\Processed\Error","381"
"11-08-2023","E:\Intra\I\IE\Processed\Error","263"
"11-09-2023","E:\Intra\I\IE\Processed\Error","223"
"11-10-2023","E:\Intra\I\IE\Processed\Error","133"
"11-11-2023","E:\Intra\I\IE\Processed\Error","3"
"11-12-2023","E:\Intra\I\IE\Processed\Success","4"
"11-13-2023","E:\Intra\I\IE\Processed\Success","4"","218"
"11-14-2023","E:\Intra\I\IE\Processed\Success","4"","200"
"11-15-2023","E:\Intra\I\IE\Processed\Error","284"

Labels (1)
Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @ravir_jbp ... for the data already logged into splunk, do you want to use Splunk Search query and get some results? (and maybe do you want to create dashboard/alert/report) 

or

do you want to onboard/ingest some csv files, but the field extraction not working as expected, please suggest, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by "my rex command does not pick up the date, filepath and count"?

This is structured data and can be onboarded as such with INDEXED_EXTRACTIONS=csv

0 Karma

ravir_jbp
Explorer

@PickleRick  can you please provide me more information on this

0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/9.1.1/Data/Extractfieldsfromfileswithstructureddata

Otherwise, if your field order is constant, you can simply parse them out with a regex indeed. But it should be relatively simple - something like

^"(?<field1>.*)","(?<field2>.*)","(?<field3>.*)"$

You have to be careful not to end your match early if you get some escaped quotes earlier in the event.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...