I am taking over a Splunk system and need to reverse-engineer a csv file input to a particular index. However, I don't know how to clearly discern the column order of the original file, because Splunk always displays fields in alphabetical order.
Does it matter if the column order of the input file changes? I'm new to Splunk and it appears to be super-smart, but is it smart enough to detect if I changed the order of the csv columns?
On
Yes, it is super smart. But It depends how you define your sourcetype. If you feed your file as csv, splunk will detect automagically all columns.
On
have a look at the actual .csv file itself. The first row in the file will always be the 'column headers' in Splunk.
If the initial line changes order, they will also change order in Splunk. If that row is generated by a script or application, reach out to your developer. If it's manual, adjust it at will with that in mind.
Have used csv input files, for me the order of columns in the .csv file has not created any problem. Just the fist row entry of a column is considered as the column title from the given data.