Splunk Search

When launching our app, why are we getting "SearchOperator: inputcsv - Encountered 'Inconsistent number of column' errors while reading input"?

TheJagoff
Communicator

Hello,

When I launch an App that was written and that we have here on site, I receive the following error (quite a few times)

WARN  SearchOperator:inputcsv - Encountered 11 'inconsistent number of column' errors while reading input

I have checked all of the CSV tables in this App's lookup directory and they appear to be consistent - meaning they have the same amount of columns relative to the header and the permissions are set to this App.

I also ran the searches separately from the app and there are no errors that come up in the Splunkd.log

Any ideas out there please?

Thank you

0 Karma
1 Solution

TheJagoff
Communicator

I'll answer my own question. I had to isolate which one of the lookup csv files was complaining. After that, there were indeed 11 occurrences where there were commas in the second field thus causing this error. There were well over 1000 lines in this file, so it was a little tedious.

View solution in original post

0 Karma

TheJagoff
Communicator

I'll answer my own question. I had to isolate which one of the lookup csv files was complaining. After that, there were indeed 11 occurrences where there were commas in the second field thus causing this error. There were well over 1000 lines in this file, so it was a little tedious.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...