Getting Data In

Use headers as fields for CSV imports on splunk cloud platform

pelican
Explorer

Hi, i'm using the splunk cloud platform for a  school project. When I import my csv files into splunk, it doesn't seem to recognise the headers of my csv as a field. Does anyone know how to get splunk to recognise my headers? thanks for any help

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer

Hi @pelican,

As a quick and dirty solution, you can select "csv" in the "Source type:" drop-down on the Set Source Type page of the Add Data process. This will tell Splunk to read field names from the first line of the file and index subsequent lines using the header fields as indexed field extractions.

After the file is indexed, you can search for it in the default index using:

sourcetype=csv

If you specified a non-default index, add the index to the search:

index=homework sourcetype=csv

View solution in original post

0 Karma

tscroggins
Influencer

Hi @pelican,

As a quick and dirty solution, you can select "csv" in the "Source type:" drop-down on the Set Source Type page of the Add Data process. This will tell Splunk to read field names from the first line of the file and index subsequent lines using the header fields as indexed field extractions.

After the file is indexed, you can search for it in the default index using:

sourcetype=csv

If you specified a non-default index, add the index to the search:

index=homework sourcetype=csv

0 Karma

pelican
Explorer

Thank you so much, I've spent at least 10 hours on this

 

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...

Splunk Smartness with Patrick Tatro | Episode 4

Welcome to another episode of "Splunk Smartness," where we explore how Splunk Education can revolutionize your ...