Splunk Search

How do I add a CSV file as an input to show the header as a field name?

akarivaratharaj
Communicator

I am trying to add the below CSV file data into Splunk as an input through the ‘Add Data’ section.
Time, Main_Release, Weekly_Release, Count

01/10/2018, 5.1, 5.1.1, 14
02/10/2018, 5.1, 5.1.2, 20
03/10/2018, 5.2, 5.2.1, 40
04/10/2018, 5.3, 5.3.1, 29

After adding the data, the events which are showing under my index and source type are as follows

Event-1 -> 01/10/2018, 5.1, 5.1.1, 14
Event-2 ->02/10/2018, 5.1, 5.1.2, 20
Event-3 ->03/10/2018, 5.2, 5.2.1, 40
Event-4 ->04/10/2018, 5.3, 5.3.1, 29

But what I am expecting is

Event-1 -> Time=01/10/2018, Main_Release=5.1, Weekly_Release=5.1.1, Count=14
Event-2 -> Time=02/10/2018, Main_Release=5.1, Weekly_Release=5.1.2, Count=20
etc.,

I am expecting the header of the CSV file to be the respective fields for each values. But it is giving me only the values available in the CSV file cell.

Could anyone please help me on this to achieve header as the field name for each events with field values?

0 Karma
1 Solution

493669
Super Champion

If you try with query-

index=<indexname>|table Time, Main_Release, Weekly_Release, Count

it should give you expected output.
you can see below events are extracted with column header as expected.
alt text

View solution in original post

493669
Super Champion

If you try with query-

index=<indexname>|table Time, Main_Release, Weekly_Release, Count

it should give you expected output.
you can see below events are extracted with column header as expected.
alt text

akarivaratharaj
Communicator

Hi @493669 ,

Thanks for your response. In the above method which you mentioned I am able to display my data on dashboard panels.

But just want to know, is there any other way to index the values with their field names in each events while adding the input file itself.

Instead of showing the below:
Event-1 -> 01/10/2018, 5.1, 5.1.1, 14
Event-2 ->02/10/2018, 5.1, 5.1.2, 20

Can we get in this way:
Event-1 -> Time=01/10/2018, Main_Release=5.1, Weekly_Release=5.1.1, Count=14
Event-2 -> Time=02/10/2018, Main_Release=5.1, Weekly_Release=5.1.2, Count=20

0 Karma

493669
Super Champion

I don't think Splunk will give in such manner but in similar way you can get in table fashion because in events splunk will show as raw i.e. the events present in csv in same way splunk will show

0 Karma

akarivaratharaj
Communicator

Okay got it. Thankyou

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...