make a table for a csv

[Soonerseast]

Hi my data is comma delimited   , there  are 2 rows with a header. I'fd like the columns to be split by the comma into a more readable table. Thanks

LOG_SEQ,LOG_DATE,LOG_PKG,LOG_PROC,LOG_ID,LOG_MSG,LOG_ADDL_MSG,LOG_MSG_TYPE,LOG_SQLERRM,LOG_SQLCODE,LOG_RECEIPT_TABLE_TYPE,LOG_RECEIPT_NUMBER,LOG_BATCH_NUMBER,LOG_RECORDS_ATTEMPTED,sOG_RECORDS_SUCCESSFUL,LOG_RECORDS_ERROR, 37205289,20250612,import_ddd,proposal_dataload (FAS),,GC Batch: 615 Rows Rejected 6,,W,,0,,,,0,0,0 37205306,20250612,hu_givecampus_import_HKS,proposal_dataload (HKS),,GC Batch: 615 - Nothing to process. Skipping DataLoader operation,,W,,0,,,,0,0,0 37205315,20250612,ddd,assignment_dataload (FAS),,GC Batch: 615 Rows Rejected 3,See harris.hu_gc_assignments_csv,W,,0,,,,0,0,0

I've tried a few things , currently I have : 

<query>((index="splunkdata-dev") source="/d01/log/log_splunk_feed.log" ) 

| eval my_field_split = split(index, ",") , log_seq = mvindex(my_field_split, 0)

, log_date = mvindex(my_field_split, 1)

,log_pkg= mvindex(my_field_split, 2)

,log_proc = mvindex(my_field_split, 3)

,log_msg = mvindex(my_field_split, 4)

,log_addl_msg= mvindex(my_field_split, 6)

, log_msg_type = mvindex(my_field_split, 7)

,log_sqlerrm = mvindex(my_field_split, 😎

, log_sqlcode= mvindex(my_field_split, 9)  | table [|makeresults |  eval search ="log_seq log_date log_pkg log_proc log_id log_msg log_addl_msg log_msg_type log_sqlerrm log_sqlcode" | table search ] table

[yuanliu]

As I always say, do not treat structured data like text.  split is not the tool for this job.  @gcusello suggests INDEXED_EXTRACTION and a way to set up extraction in props.conf.  Short of these, you can also use multikv

| multikv

[gcusello]

Hi @Soonerseast ,

why are you not using the INDEXED_EXTRACTION = csv?

anyway, you can put in props.conf:

[your_sourcetype]
HEADER_FIELD_LINE_NUMBER=1
FIELD_DELIMITER=,
FIELD_QUOTE="

if eventually, yo don't need the header as an event, you can remove it,

Ciao.

Giuseppe

[richgalloway]

Please put the query in a code block so it's easier to read and to avoid it being rendered in emoticons.

How is this query not working for you?  What are the expected results and what results so you get?

The split function should not be using 'index' as the first argument.  The value of that field, "splunkdata-dev" does not contain any commas.  You probably should use _raw.

What is the intention of the subsearch in the table command?