Getting Data In

index empty csv file

surekhasplunk
Communicator

Hi,

I want to know if i can index a csv file with just the headers without any data in it.

If i search for index=indexname what will i see. and if i try to export the same to a outputfile while will be generated in the output file.

Thanks

Tags (3)
0 Karma

ssadanala1
Contributor

If you want to create lookup file as place holder

you can create a null file by running this in search

|outputlookup yourplaceholderlookupname.csv

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Assuming you've correct configuration to parse the file data as CSV, and empty-file/just-headers, will not get indexed. Splunk stores raw data with metadata information not just the metadata. Since no results will be shown at search, you won't be able to export or outputfile or outputcsv.

surekhasplunk
Communicator

Perfect...

thanks @somesoni2 . You explained really well.

0 Karma

p_gurav
Champion

Could you please tell me the requirement to do this?

0 Karma

surekhasplunk
Communicator

hi @p_gaurav,

I just want to index a file which has no data in it and just the headers. so that when i search for the index on the seach head i just get the headers shown without any data and the csv generated should have just the headers with no data

0 Karma

adonio
Ultra Champion

like @p_gurav mentioned, i am not sure regarding this requirement
also, when indexing a csv file, splunk will avoid the header if there is no values under it.
you can try and use the lookup editor app or use a lookup for this requirement.
hope it helps

0 Karma

jvardev
Path Finder

You can index it, but wont see nothing at search time. I have imported a file with header and without data with Splunk Enterprise 7.0.3.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...