Splunk Search

Uploading a CSV with multiline field value

ChhayaV
Communicator

hi,

I want to do a lookup to a CSV file which is having multi line field value when i upload a file for lookup its givng me error as file is in binary format.
How can i upload such CSV or is there any other way to do lookup for fields with multi line value?

Thanks and regards

Tags (3)
0 Karma

sowings
Splunk Employee
Splunk Employee

I created a lookup like this (note the quotes):


field,value
"key","This is a multi-line string
that lives in a CSV file."

It worked just fine, but the search results (| inputlookup foo.csv) ended up eliding the newlines, so the "value" side came out as just a long string.

Could it be that your multi-line values are not quoted?

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

There is no problem with the structure, so I wonder if there are hidden binary characters that are inhibiting the upload. you might want to see if you text editor can reveal hidden characters so you can clean them up if need be.
The exact error will help as well.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

ChhayaV
Communicator

hi,
yea its a comma delimited file and i am able to edit in text editor.
Sample entry in file

message
A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible

solution
try below options, set command timeout parameter to 0. It will execute till the end. By default it will timeout in 30 secs.
sqlComm.CommandTimeout = 0

where "mesasge" and "solution" are two filed in my csv

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

It isn't completely clear from what you've said, but is the file a comma delimited text file or is it something else? Does it contain binary characters? Can you open it and edit it in a text editor?

It would also help to provide a sample of the file here so we are clear on what you mean by multiline exactly.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...