Splunk Search

Prop Conf for CSV input data

SplunkDash
Builder

Hello,

Please let me know how I would write Props Configuration file for this csv file. Segment of sample data for this csv file is given below. Any help will be highly appreciated, thank you!

 

malekmo_1-1626381853803.png

 

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @SplunkDash 

can you try this and deploy it to UF not on HF/intermediate forwarder. Restart UF.

 

## props.conf
[your_sourcetype]
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = CSV
DATETIME_CONFIG = CURRENT

 

--

An upvote would be appreciated and Accept the solution if this reply helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @SplunkDash 

can you try this and deploy it to UF not on HF/intermediate forwarder. Restart UF.

 

## props.conf
[your_sourcetype]
HEADER_FIELD_LINE_NUMBER = 1
INDEXED_EXTRACTIONS = CSV
DATETIME_CONFIG = CURRENT

 

--

An upvote would be appreciated and Accept the solution if this reply helps!

codebuilder
SplunkTrust
SplunkTrust

Since you have structured data with a header you can use the built-in CSV sourcetype. Just set sourcetype = csv inputs.conf on your forwarder.

Or you can create a custom one using INDEXED_EXTRACTIONS = csv
See the documentation below for details and additional settings.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Extractfieldsfromfileswithstructureddata#Use...

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

SplunkDash
Builder

Thank you. But, I used

 

DATETIME_CONFIG=current

SHOULD_LINEMERGE=false

LINE_BREAKER=([\r\n]+)

NO_BINARY_CHECK=true

CHARSET=UTF-8

EVAL-_raw=replace(_raw,"\"","")

INDEXED_EXTRACTIONS=csv

KV_MODE=none

category=Structured

but, showing no events.......when I take off "DATETIME_CONFIG=current" and leave this value blank... it's showing events with error messages ("Failed to parse timestamp"). Any help will be highly appreciated. 

 

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Where are you putting this? Also, why are you doing replacements on _raw?

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

SplunkDash
Builder

_raw  just generated automatically from the system when I pull the source file  through SPLUNK web console to test my PROPS. It doesn't make any differences if I take off take option

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...