Getting Data In

Index only one column from csv input

vinaykata
Path Finder

I wanted to index only "Date" column from this CSV file. I don't want any of the other columns to be indexed and want to skip the first row before indexing. This is a continuous monitoring file. Is there any possible way to extract a single column from CSV input file?

Tags (1)
0 Karma

maciep
Champion

I think you could add some parsing config on your indexer to handle this. First, you could call transforms to remove the header row (assuming that's the first row you don't want) and then SEDCMD to replace the first comma and the rest of the event with nothing.

Something like this maybe (tried match both of the non-data rows in sample for discard). This not tested so may but hopefully not too many typos..

props.conf

[your_sourcetype]
TIMESTAMP_FORMAT = %m/%d/%Y
SHOULD_LINEMERGE = false
TRANSFORMS-drop_header = drop_header
SEDCMD-keep_first_row = s/^([^,]+).+/\1/g

transforms.conf

[drop_header]
REGEX = ^(Date|Report)
DEST_KEY = queue
FORMAT = nullQueue
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...