The CSV header is not an event

The header names columns

A CSV from a log script starts with a title row: the field names the script chose. That row is documentation for the rows under it. It is not an event from the log, even when a column is called user or ip.

Count data rows, not the title row. A file with a header and two data rows has two events.

An empty cell stays in its column

A blank user cell means that field was empty in the output for that row. The column still exists because the header named it. Do not drop the column, and do not copy the header word “user” into the blank as if it were the account.

A column that is not in the header was not printed. Do not add a timestamp column because logs usually have one.

What to write down

File the header as the column list, then each data row you cite. Say when a cell is empty. If you import the file into a sheet, confirm the title row was not counted as an event.

Lab: the word user counted as an account

The summarizer writes a CSV whose first row is ip,user,count and whose next row is 203.0.113.10,labuser,4. A draft says two accounts appeared: user and labuser, because both words are in the file.

The note says the first row is the column list. The only data row names labuser with count 4. The word user is the column title. It is not an account from the log.

header: ip,user,count
data: 203.0.113.10,labuser,4
data rows: 1
write: one event, account labuser
not: an account named user