Skip to main content
Solved

How to use first line in CSV as the headers for Parser function

  • March 11, 2025
  • 2 replies
  • 26 views

Shawn Cannon
Forum|alt.badge.img

So I have a script that will collect data from an API. The data is returns is CSV formatted, the first line will be the list of fields. How do you tell Stream to use that first line as the headers?

Best answer by Brendan Dalpe

Hi @rolltidega, Cribl Stream has a default "CSV Ruleset" that will extract the field names based on the CSV header and automatically unroll each line into an individual event.

Im assuming youre using a scripted collector… you can add the event breaker by opening the scripted collector config and click on Event Breakers on the left side of the config. Add a ruleset and select "CSV Ruleset" from the dropdown.

2 replies

  • Inspiring
  • Answer
  • March 11, 2025

Hi @rolltidega, Cribl Stream has a default "CSV Ruleset" that will extract the field names based on the CSV header and automatically unroll each line into an individual event.

Im assuming youre using a scripted collector… you can add the event breaker by opening the scripted collector config and click on Event Breakers on the left side of the config. Add a ruleset and select "CSV Ruleset" from the dropdown.


Shawn Cannon
Forum|alt.badge.img
  • Author
  • Known Participant
  • March 11, 2025

Yeah I found that thanks.