Splunk® Enterprise

Search Reference

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

inputcsv

Description

Populates the results data structure using the given csv file, which is not modified. The filename must refer to a relative path in $SPLUNK_HOME/var/run/splunk and if the specified file does not exist and the filename did not have an extension, then filename with a .csv extension is assumed. Updates to $SPLUNK_HOME/var/run/csv*.csv using outputcsv are not replicated across the cluster.

Note: If you run into an issue with inputcsv resulting in an error, make sure that your CSV file ends with a BLANK LINE..

Syntax

inputcsv [append=<bool>] [start=<int>] [max=<int>] [events=<bool>] <filename>

Required arguments

filename
Syntax: <filename>
Description: Specify the name of the CSV file, located in $SPLUNK_HOME/var/run/splunk.

Optional arguments

append
Syntax: append=<bool>
Description: Specifies whether the data from the CSV file is appended to the current set of results (true) or replaces the current set of results (false).
Default: false
events
Syntax: events=<bool>
Description: Allows the imported results to be treated as events so that a proper timeline and fields picker are displayed.
max
Syntax: max=<int>
Description: Controls the maximum number of events to be read from the file. If max is not specified, there is no limit to the number of events that can be read.
Default: 1000000000 (1 billion)
start
Syntax: start=<int>
Description: Controls the 0-based offset of the first event to be read.
Default: 0

Examples

Example 1: Read in results from the CSV file: "$SPLUNK_HOME/var/run/splunk/all.csv", keep any that contain the string "error", and save the results to the file: "$SPLUNK_HOME/var/run/splunk/error.csv"

| inputcsv all.csv | search error | outputcsv errors.csv

Example 2: Read in events 101 to 600 from either file 'bar' (if exists) or 'bar.csv'.

| inputcsv start=100 max=500 bar

Example 3: Read in events from the CSV file: "$SPLUNK_HOME/var/run/splunk/foo.csv".

| inputcsv foo.csv

See also

outputcsv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the inputcsv command.

PREVIOUS
input
  NEXT
inputlookup

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14


Comments

Woodcock - There is no limit.

Lstewart splunk, Splunker
December 29, 2015

What is the limit on inputcsv?

Woodcock
July 18, 2015

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters