Does a CSV import connector or a XML import connector exist in current Splunk versions?

lwedekind — Mon, 15 Aug 2022 13:43:46 GMT

Does a CSV import connector or a XML import connector exist in current Splunk versions?:)

Re: Does a CSV import connector or a XML import connector exist in current Splunk versions?

gcusello — Mon, 15 Aug 2022 15:02:36 GMT

there isn't a predefined connector, because Splunk doesn't use connectors.

But when you have to ingest a csv or a xml file, you have to configure in props.conf an option, called "INDEXED_EXTRACTIONS" and in this way the format is recognized.

INDEXED_EXTRACTIONS = <CSV|TSV|PSV|W3C|JSON|HEC> * The type of file that Splunk software should expect for a given source type, and the extraction and/or parsing method that should be used on the file. * The following values are valid for 'INDEXED_EXTRACTIONS': CSV - Comma separated value format TSV - Tab-separated value format PSV - pipe ("|")-separated value format W3C - World Wide Web Consortium (W3C) Extended Log File Format JSON - JavaScript Object Notation format HEC - Interpret file as a stream of JSON events in the same format as the HTTP Event Collector (HEC) input. * These settings change the defaults for other settings in this subsection to appropriate values, specifically for these formats. * The HEC format lets events overide many details on a per-event basis, such as the destination index. Use this value to read data which you know to be well-formatted and safe to index with little or no processing, such as data generated by locally written tools. * When 'INDEXED_EXTRACTIONS = JSON' for a particular source type, do not also set 'KV_MODE = json' for that source type. This causes the Splunk software to extract the JSON fields twice: once at index time, and again at search time. * Default: not set

You can find more infos at https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf

Ciao.

Giuseppe

topic Re: Does a CSV import connector or a XML import connector exist in current Splunk versions? in Getting Data In

Does a CSV import connector or a XML import connector exist in current Splunk versions?

Re: Does a CSV import connector or a XML import connector exist in current Splunk versions?