All,
I am trying to read a csv file using the inputcsv command. I can't seem to figure out why, but the command isn't returning any results. The file (call it names.csv) is a list of names, like so:
Users
Bob Smith
Joe Somebody
John Doe
The file is located in var/run/splunk, as the documentation on inputcsv says it should. When I run the command
|inputcsv names.csv
I get no search results. Clicking the "Inspect..." link provides the following details:
This search has completed, but did not match any events. The terms specified in the highlighted portion of the search:None | inputcsv names.csv
"None" is the highlighted portion of the search, which makes me believe that it is not correctly parsing the inputcsv command as it should. I could, however, just be misinterpreting how the command should be used.
Any help you could provide would be greatly appreciated. Thanks!