Search Reference

inputcsv

Description

Loads search results from the specified .csv file, which is not modified. The filename must refer to a relative path in $SPLUNK_HOME/var/run/splunk (or $SPLUNK_HOME/var/run/splunk/dispatch/<job id>/ if dispatch = true). If the specified file does not exist and the filename does not have an extension, then the Splunk software assumes it has a filename with a .csv extension.

Note: If you run into an issue with the inputcsv command resulting in an error, ensure that your .csv file ends with a BLANK LINE.

Syntax

| inputcsv [dispatch=<bool>] [append=<bool>] [start=<int>] [max=<int>] [events=<bool>] <filename> [WHERE <search-query>]

Required arguments

filename

Syntax: <filename>

Description: Specify the name of the .csv file, located in $SPLUNK_HOME/var/run/splunk.

Optional arguments

dispatch

Syntax: dispatch=<bool>

Description: When set to true, this argument indicates that the filename is a .csv file in the dispatch directory. The relative path is $SPLUNK_HOME/var/run/splunk/dispatch/<job id>/.

Default: false

append

Syntax: append=<bool>

Description: Specifies whether the data from the .csv file is appended to the current set of results (true) or replaces the current set of results (false).

Default: false

events

Syntax: events=<bool>

Description: Allows the imported results to be treated as events so that a proper timeline and fields picker are displayed.

max

Syntax: max=<int>

Description: Controls the maximum number of events to be read from the file. If max is not specified, there is no limit to the number of events that can be read.

Default: 1000000000 (1 billion)

start

Syntax: start=<int>

Description: Controls the 0-based offset of the first event to be read.

Default: 0

WHERE

Syntax: WHERE <search-query>

Description: Use this clause to improve search performance by prefiltering data returned from the lookup table. Supports a limited set of search query operators: =, !=, <, >, <=, >=, AND, OR, NOT. Any combination of these operators is permitted. Also supports wildcard string searches.

Usage

The inputcsv command is a generating commandand should be the first command in the search. Generating commands use a leading pipe character.

If append is set to true, the Splunk software appends the data from the .csv file to the current set of results. append is set to false by default, which means that it replaces the current result set with the results from the lookup search.

The WHERE clause allows you to narrow the scope of the query that inputlookup makes against the lookup table. It restricts inputlookup to a smaller number of lookup table rows, which can improve search efficiency when you are working with significantly large CSV lookup tables.

Examples

Example 1: Read in results from the .csv file: "$SPLUNK_HOME/var/run/splunk/all.csv", keep any that contain the string "error", and save the results to the file: "$SPLUNK_HOME/var/run/splunk/error.csv"

| inputcsv all.csv | search error | outputcsv errors.csv

Example 2: Read in events 101 to 600 from either file 'bar' (if exists) or 'bar.csv'.

| inputcsv start=100 max=500 bar

Example 3: Read in events from the .csv file: "$SPLUNK_HOME/var/run/splunk/students.csv" where the age is greater than 13, less than 19, but not 16. Provide a count of the events received.

| inputcsv students.csv WHERE (age>=13 age<=19) AND NOT age=16 | stats count

See also

outputcsv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the inputcsv command.