index empty csv file

[surekhasplunk]

Hi,

I want to know if i can index a csv file with just the headers without any data in it.

If i search for index=indexname what will i see. and if i try to export the same to a outputfile while will be generated in the output file.

Thanks

[ssadanala1]

If you want to create lookup file as place holder

you can create a null file by running this in search

|outputlookup yourplaceholderlookupname.csv

[somesoni2]

Assuming you've correct configuration to parse the file data as CSV, and empty-file/just-headers, will not get indexed. Splunk stores raw data with metadata information not just the metadata. Since no results will be shown at search, you won't be able to export or outputfile or outputcsv.

[surekhasplunk]

Perfect...

thanks @somesoni2 . You explained really well.

[p_gurav]

Could you please tell me the requirement to do this?

[surekhasplunk]

hi @p_gaurav,

I just want to index a file which has no data in it and just the headers. so that when i search for the index on the seach head i just get the headers shown without any data and the csv generated should have just the headers with no data

[adonio]

like @p_gurav mentioned, i am not sure regarding this requirement
also, when indexing a csv file, splunk will avoid the header if there is no values under it.
you can try and use the lookup editor app or use a lookup for this requirement.
hope it helps

[jvardev]

You can index it, but wont see nothing at search time. I have imported a file with header and without data with Splunk Enterprise 7.0.3.