Splunk Search

Why am I getting error "File has no line endings" when trying to upload my lookup CSV file?

ashnet16
Path Finder

Every time I try I try to upload my CSV, I receive the following message:

Encountered the following error while trying to save: In handler 'lookup-table-files': File has no line endings.

I added the file directly to the $SPLUNK_HOME/etc/apps//local/, but no results are returned. Any thoughts?

Tags (3)
0 Karma

l0gik
Explorer

I had an xls file that I saved over as .csv to use as a lookup and I got this error when trying to use the file that way. I advise to bring the file in to notepad++, click view->show symbols-> show all characters, you want to see CR LF af the end of each line. If you see CR only go to edit->EOL Conversion->Windows Format.

As info CR stands for Carriage Return
LF stands for Line Feed

Linux format only uses CR whereas windows format uses CR and LF together. Apparently splunk is looking for these LF indicators to denote line endings.

daniel_augustyn
Contributor

Just open a CSV file with a text editor like Sublime for example, remove extra characters at the end, save it as a CSV file.

saurabh_tek11
Communicator

I opened that CSV file with notepad++ and hit enter in the last of first row.
so my csv now has 2 rows.
i saved it and it didn't give the error this time.

0 Karma

tlagatta_splunk
Splunk Employee
Splunk Employee

This is a common problem when converting an Excel file to CSV. Try saving it as Windows Comma Separated Value (.csv), then you should be able to successfully upload the lookup.

(Thanks to some friendly PS consultants for the help!)

MarioM
Motivator

is your file utf8 encoded? and .csv? if added manually the csv file has to be in $SPLUNK_HOME/etc/apps/app_name/lookups then you need to add the following in $SPLUNK_HOME/etc/apps/app_name/local/transforms.conf :

[<any name>]
filename = myfile.csv
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...