Deployment Architecture

When trying to do a CSV data upload and create an index, how come no lines and events are found in the event summary?

flopit
Path Finder

Hi I am trying to do a .csv file upload and create an index.

I am afraid I can not upload the file due to lack of karma points.
So here is the start of it:

a002,a003,a005,a006,a007,a008,a101,a001,a009,a010,a012,a034,a046,a054,a055,a058,a072,a073,a075,a077,a078,a098,a100,a102,a103,a104,a105,d003,d004,d005,d006,d041,d042,d043,d044,d046,d047,d048,d049,d050,d051,d052,d053,d059,d115,time,mac_nwpm
46.599998,48.299999,49.400002,32.900002,-999.900024,-999.900024,0,16.6,0,0,0,5,20,31.4,21.4,52,157.100006,156,0,113,0,0,0,0,11,0,0,0,0,0,0,0,1,1,0,0,0,0,1,0,1,0,0,1,0,27.09.2018 10:44,00:0a:5c:10:70:ca
39.700001,50,39.099998,15.9,13.2,37.400002,10.8,12.1,32,-999.900024,0,7,20,29.9,22.700001,50,204.300003,0,0,71.099998,0,29.9,17.1,32.700001,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,1,1,27.09.2018 10:44,00:0a:5c:1f:86:3b
27.6,51.299999,27.700001,-999.900024,-999.900024,-999.900024,0,13.6,0,0,0,29.299999,20,22.299999,22.299999,50,254.600006,172.199997,7.4,55,15,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,1,1,0,27.09.2018 10:44,00:0a:5c:10:70:f0
29.9,52.900002,29.1,12.9,12.5,36.900002,10.5,14.8,29.799999,29.9,0,7,20,29.799999,29.799999,50,165,164.800003,26,27.5,44.5,19,7.1,32.700001,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,0,27.09.2018 10:44,00:0a:5c:10:71:20
25.4,46.700001,25.700001,0,0,10.2,10.2,11.2,25.4,0,0,50,20,26.1,23,49,251.600006,0,6.6,24.4,0,22.200001,11.3,32.900002,1,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,0,0,1,0,27.09.2018 10:44,00:0a:5c:10:8d:ca
24.5,48.400002,22.6,19.1,19.299999,-999.900024,0,13.3,0,0,0,99,20,22.299999,22.299999,50,2.7,0,0,0.9,1.6,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,1,0,27.09.2018 10:44,00:0a:5c:10:f7:99
22.200001,54.599998,22,58.400002,14.3,43.099998,0,9.7,-999.900024,-999.900024,0,7,20,23.6,23.6,56,255.100006,202.399994,0.6,256.600006,52.599998,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,1,1,0,27.09.2018 10:44,00:0a:5c:10:f6:75
35.200001,48.200001,32.900002,32.5,11.5,32.299999,0,10.1,0,0,0,99,20,31,31,50,222.800003,0,7.1,62.700001,77.5,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,1,0,27.09.2018 10:44,00:0a:5c:10:92:3d

Basically, it as a header line with the column names, consisting of register names (axyzs), a time field called "time", and an identifier field called "macnwpm".

I can upload the file, but in the 2nd step, "set source type" seems to not be able to identify the file's structure.

I also set parameter that "header" is in in line 1 and that the "time format" is %d.%m.%Y %H:%M
and that the time field is called "time".

But still, it seems it can not identify the structure correctly because the "event summary" says there are 0 lines and 0 events found.

Are there any other parameters I need to do define?

Think the .csv itself is ok because I can do a .csv-import in excel and the columns look ok there.

Best,
Florian

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...