Getting Data In

When I use the inputcsv command with my data, I see an eventcount, but the events are blank. Why is this?

ycalpu
New Member

Hi all, when i do an inputcsv command, I see the data in the file I put on the splunk server. Since I want to see them as events I query the following:
| inputcsv filename.csv (I see all the data, 7603 counted)
| inputcsv start=1 events=yes filename.csv (I get the 7602 count, but showing all blank)

Any ideas why its showing blanks?

Tags (2)
0 Karma

jrodman
Splunk Employee
Splunk Employee

Events in the event viewer will generally be blank unless they include a _raw field. Your sv file probably does not have a field (or column) called _raw, which is the text of the event.

0 Karma

ycalpu
New Member

jrodman, how do you designate the _raw field?

Y

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...