All Apps and Add-ons

CSV Ingestion - Unable to use headers as fields, and data will not separate by column - Preview shows otherwise

franzferd
Engager

Hello!

So I am trying to ingest a CSV File. When at the preview screen prior to ingestion, all field names and columns line up and populate as expected. When I submit the data for ingestion, the fields aren't captured, and the data doesn't separate by comma. I have tried numerous different approaches: I attempted to manually set the field names in the transforms.conf, I eliminated the spaces in the field names, I've made a few modifications to the props.conf files, and so on. What am I missing?

Below is a snippet of the CSV:

IP Address,Device Name,MAC Address,Network Adapter Company,Device Information,User Text,First Detected On,Last Detected On,Detection Count,Active
10.0.0.203,EditedComputerName,0F-0F-0F-0F-0F-0F,Intel Corporate,,EditedComputerName,1/25/2018 8:25:22 PM,1/25/2018 9:00:40 PM,1,No
10.0.0.159,,0F-0F-0F-0F-0F-0F,SAMSUNG ELECTRO-MECHANICS(THAILAND),,,1/25/2018 2:13:32 AM,1/27/2018 1:12:35 PM,1,No

Here is my props.conf:

[MySourceType]
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
CHARSET = AUTO
INDEXED_EXTRACTIONS = csv
KV_MODE = none
disabled = false
pulldown_type = true
TIMESTAMP_FIELDS = "Last Detected On"

EDIT: I have also tried the Splunk Field Extractor, and the result remains unchanged.

0 Karma

felipesewaybric
Contributor

Everything looks fine, try install the CSV lookup Editor and open your csv file.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...