topic How to ingest csv file into Heavy forwarder instance and forward data to a peer index in Deployment Architecture

How to ingest csv file into Heavy forwarder instance and forward data to a peer index

Sabareesh — Wed, 30 Dec 2020 15:26:21 GMT

I need to get the csv file into HF and forward it to an indexer

How do i add csv file to HF...Do i need to create stanza in inputs.conf to monitor the file.If pls let me know the stanza.

saravanan90 — Wed, 30 Dec 2020 16:43:59 GMT

Below may help.

For Linux :

[monitor:///opt/splunk/var/log/splunk/temp.csv]
index = main
sourcetype = csv
disabled = 0
crcSalt = <SOURCE>

For Windows

[monitor://C:\splunk\var\log\splunk\temp.csv]
index = main
sourcetype = csv
disabled = 0
crcSalt = <SOURCE>

Sabareesh — Sun, 03 Jan 2021 12:17:22 GMT

Thanks for the Stanza.

I want to know how to place a temp.csv file into that path?

saravanan90 — Sun, 03 Jan 2021 12:23:31 GMT

The stanza will monitor the temp.csv file in HF & forward it to indexer.

The temp.csv can be placed manually or pushed through any script to that path.

KimiYan — Tue, 29 Jun 2021 02:15:25 GMT

Dear friend, have you solved your problem ? I have the same requirements as yours. Hope you can share your stanza.