Hi All,
I am new to splunk and when I try to search an excel file with one of the columns like id i am not getting any result.Can you please help me.
Thanks Jim
Id Project Reporter Assigned To Priority Severity Reproducibility 0032835 * Reporting (Prod) JIm, JOHN normal minor have not tried.
I have an CSV file with header in first line and data as second line.
When i try to search like this source="C:\UsersSplunk\ACsv_exp.csv"
i gettign all the rows in excel file.
When i modify serach like source="C:\Users\30136321\Desktop\Splunk\MantisCsv_exp.csv" "id=0032835"
i am getting "No results found.." Id 0032835 is present in CSV file
For inputing the file "I choose From files and directories" option and for indexing i opt for "Continuously index data from a file or directory this Splunk instance can access" option.
Can you help me ?
Thanks in advance.
source="C:\UsersSplunk\ACsv_exp.csv"
should definitely give you all the rows in the file.
source="C:\Users\30136321\Desktop\Splunk\MantisCsv_exp.csv" "id=0032835"
searches for the string id=0032835
, which is obviously not in your file. Try one of these
source="C:\Users\30136321\Desktop\Splunk\MantisCsv_exp.csv" 0032835
The above searches for 0032835 anywhere in the file.
source="C:\Users\30136321\Desktop\Splunk\MantisCsv_exp.csv" id=0032835
Without quotes, id=0032835
searches for the value 0032835 in a field named id
. This will work only if you have defined the fields in your file to Splunk. If you set the sourcetype of the input to CSV
, then this should work.
jimjohn, if this answer solved your problem, please accept it by checking the box. it's also polite to upvote the answer if it helped you 🙂
Yes now its working for me.Wat i did wrong is instead of searching with Id I search with id.
what is the sourcetype provided? Try searching with that. And how do you get excel file when searching the csv file!