Getting Data In

CSV Headers appearing as events

tc641
New Member

My events are appearing on Splunk and the fields are getting extracted however the header is appearing as an event every day that the file is updated. So this appears as an event:

"user_name","name","number","opened_at"

My data is very standard:

"user_name","name","number","opened_at"
"Bob","Sarah","X10924704","2017-07-18 19:59:18"
...
...

I'm fairly new to Splunk but I have researched this problem and haven't found a solution.

So I used Splunk Web to create a props.conf which is as follows:

[sourcetype1]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true

On Splunk Web this did not display the headers as events.

This is on my forwarder and as I said the events are appearing and fields are getting extracted.

I have tried doing this:

[sourcetype1]
TRANSFORMS-NoHeader = NoHeader

on your transforms.conf add this:
[NoHeader]
REGEX = "user_name","name","number","opened_at"
DEST_KEY = queue
FORMAT = nullQueue

Which did not work -- I'm also unsure why it would be necessary. Splunk understands that the data is a CSV so why would it think the headers are events?!

I'll also put inputs.conf and indexes.conf below (I don't know if it is necessary):

[index1]
homePath = volume:hotData/index1/db
coldPath = volume:coldData/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb
homePath.maxDataSizeMB = 2560
coldPath.maxDataSizeMB = 5120

[monitor://\sever\folder\file]
disabled = false
followTail = 0
index = index1
sourcetype = sourcetype1
ignoreOlderThan = 5d

Any help would be appreciated 🙂

0 Karma
1 Solution

skalliger
SplunkTrust
SplunkTrust

Hi,

if your header is always in line 1, then simply set these options (found in props.conf):
Your props.conf is way too oversized for a simple csv import. Don't specify so many options you don't know exactly.

HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
FIELD_DELIMITER = ,

Not so sure if it is
= ","
or
= ,
Just try both.

Skalli

View solution in original post

skalliger
SplunkTrust
SplunkTrust

Hi,

if your header is always in line 1, then simply set these options (found in props.conf):
Your props.conf is way too oversized for a simple csv import. Don't specify so many options you don't know exactly.

HEADER_FIELD_LINE_NUMBER = 1
HEADER_FIELD_DELIMITER = ,
FIELD_DELIMITER = ,

Not so sure if it is
= ","
or
= ,
Just try both.

Skalli

tc641
New Member

I just copied the config when splunk web created it as it was working there. I'll try this and hopefully it works 🙂

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...