Getting Data In

Why did Splunk data load skip a field assignment for a column name from a source view?

Rmc06010
Explorer

Hello,

I'm having an issue with a .csv file containing data from an Oracle database view that is being extracted nightly and ingested into Splunk. I'm not involved in the Splunk configuration side of things at my job. I requested the data be sent to Splunk so that I can integrate it into various dashboards I'm developing.

The issue is that Splunk has shifted the field names one column to the right, so to speak. Say the column names from the source view are A, B, C, D, E, F, G, H, ......, Y, Z.

A, B, C, and D have corresponding fields in Splunk and they contain the appropriate values. However, starting with column E, the corresponding field in Splunk that contains the values for the E column is named F instead. This trend continues (Splunk field that contains values from column F in the source view is named for column G, etc...) until the penultimate field, which is named for the final column from the source view (Z) but contains values from column Y. Then, there is a field named EXTRA_FIELD_21. This field contains the values for column Z in the source view.

Apologies for the description, I'm finding the issue difficult to articulate. Basically, EXTRA_FIELD_21 should be named E instead and field values should be 'shifted' to the right by one starting with that field.

Any idea what may be causing this? All commas and equals symbols have been removed from the view. There is nothing but letters and dashes in the view column E. Thanks in advance for any insight!

0 Karma

woodcock
Esteemed Legend

This can happen if you are not properly protecting commas inside of your events with double-quotes. For example, if you have this, then it will work:

A,B,C,D,E,F,
"A","B","C","D,1","E","F"

But if your data, particularly your value for field D which has a comma in it, you will have this:

A,B,C,D,E,F,
A,B,C,D,1,E,F

Then fields D on out will be wrong.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Look closely at the values for field D. It's possible Splunk is interpreting them as two separate values (D and E).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...