Getting Data In

Why did Splunk data load skip a field assignment for a column name from a source view?

Rmc06010
Explorer

Hello,

I'm having an issue with a .csv file containing data from an Oracle database view that is being extracted nightly and ingested into Splunk. I'm not involved in the Splunk configuration side of things at my job. I requested the data be sent to Splunk so that I can integrate it into various dashboards I'm developing.

The issue is that Splunk has shifted the field names one column to the right, so to speak. Say the column names from the source view are A, B, C, D, E, F, G, H, ......, Y, Z.

A, B, C, and D have corresponding fields in Splunk and they contain the appropriate values. However, starting with column E, the corresponding field in Splunk that contains the values for the E column is named F instead. This trend continues (Splunk field that contains values from column F in the source view is named for column G, etc...) until the penultimate field, which is named for the final column from the source view (Z) but contains values from column Y. Then, there is a field named EXTRA_FIELD_21. This field contains the values for column Z in the source view.

Apologies for the description, I'm finding the issue difficult to articulate. Basically, EXTRA_FIELD_21 should be named E instead and field values should be 'shifted' to the right by one starting with that field.

Any idea what may be causing this? All commas and equals symbols have been removed from the view. There is nothing but letters and dashes in the view column E. Thanks in advance for any insight!

0 Karma

woodcock
Esteemed Legend

This can happen if you are not properly protecting commas inside of your events with double-quotes. For example, if you have this, then it will work:

A,B,C,D,E,F,
"A","B","C","D,1","E","F"

But if your data, particularly your value for field D which has a comma in it, you will have this:

A,B,C,D,E,F,
A,B,C,D,1,E,F

Then fields D on out will be wrong.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Look closely at the values for field D. It's possible Splunk is interpreting them as two separate values (D and E).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...