Getting Data In

FIELD_NAMES for Missing Headers of CSV

emccaslin
Path Finder

I have a comma separated csv file with missing headers. From the props.conf.spec below it has the configuration setting in your props.conf file:


FIELD_NAMES = [ <string>,..., <string>]
* Some CSV and structured files might have missing headers. This attribute tells Splunk to specify the header field names directly.

My problem is I have been unable to get this to work. I push this into the props.conf file and when the logs are indexed I cannot find the field names.

Example csv file looks like this:


1,2,3,4,5
6,7,8,9,10

The headers should be a,b,c,d,e, so what should I set FIELD_NAMES equal to?

FIELD_NAMES = [a,b,c,d,e]
or
FIELD_NAMES = ["a","b","c","d","e"]
or
FIELD_NAMES = [<a>,<b>,<c>,<d>,<e>]
or
FIELD_NAMES = [<"a">,<"b">,<"c">,<"d">,<"e">]

or some other variation? I tried running btool check on my configurations but it doesn't reject what I have tried.

Tags (2)
0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Here is what you need to have:

Some data in a log file:

place1,41.66164,-87.74477
place2,41.66587,-86.894357
place3,41.72614,-85.97314

inputs.conf - Ensure you set a sourcetype

[monitor:///Users/splunker/Desktop/places.log]
sourcetype=geo

props.conf - Referencing the sourcetype

[geo]
SHOULD_LINEMERGE = false
FIELD_NAMES = location,latitude,longitude

alt text

View solution in original post

dmaislin_splunk
Splunk Employee
Splunk Employee

Here is what you need to have:

Some data in a log file:

place1,41.66164,-87.74477
place2,41.66587,-86.894357
place3,41.72614,-85.97314

inputs.conf - Ensure you set a sourcetype

[monitor:///Users/splunker/Desktop/places.log]
sourcetype=geo

props.conf - Referencing the sourcetype

[geo]
SHOULD_LINEMERGE = false
FIELD_NAMES = location,latitude,longitude

alt text

dmaislin_splunk
Splunk Employee
Splunk Employee

Please Accept the answer by selecting the check box next to my answer! Thanks!

0 Karma

emccaslin
Path Finder

Thank you!

0 Karma

emccaslin
Path Finder

My data is not enclosed in brackets, and removing the brackets from FIELD_NAMES did not work. Now I am just adding a field extraction and field transformation post-processing to deal with this issue.

0 Karma

lukejadamec
Super Champion

Try removing the brackets:

FIELD_NAMES = "a","b","c","d","e"

Is your data enclosed in brackets?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...