topic Re: Uploading a csv file into Splunk without adding it onto the physical splunk server in Getting Data In

Is it possible to upload a csv file into Splunk without adding it onto the physical splunk server?

splunkman341 — Mon, 24 Oct 2022 13:07:10 GMT

Hi guys,

I've roamed the prestigious documents of splunk on how to go about this but I am stumped and can't find any guidance. Just as the question states, I am trying to upload a csv file into splunk, without having to go on the physical splunk server and moving it in. Is this possible?

Thanks in advance for your help

Re: Uploading a csv file into Splunk without adding it onto the physical splunk server

lquinn — Wed, 17 Jun 2015 15:57:14 GMT

Can you access the Splunk UI from the server where the file is? Then you could just go to Settings > Add Data, then drag and drop the file.

Re: Uploading a csv file into Splunk without adding it onto the physical splunk server

splunkman341 — Wed, 17 Jun 2015 17:33:09 GMT

Thanks for your response.

So i went to Settings > look ups > look up table files and when I tried to add my csv file I get an error message saying : Encountered the following error while trying to save: In handler 'lookup-table-files': File has no line endings.

Any idea on how to successfully upload it?

Re: Uploading a csv file into Splunk without adding it onto the physical splunk server

splunker12er — Thu, 18 Jun 2015 01:12:33 GMT

There might be some problem in the file, which you are trying to upload, this is a common problem when converting an Excel file to CSV.

Try saving it as Windows Comma Separated Value (.csv), then you should be able to successfully upload the lookup.

Re: Uploading a csv file into Splunk without adding it onto the physical splunk server

LukeMurphey — Thu, 18 Jun 2015 18:28:35 GMT

Try using the Lookup Editor app. It provides an interface for uploading lookup files and it will even correct incompatible line endings.

To upload a file, do the following:

Open the Lookup Editor
Click "New"
Click the file selector at the top right of the screen near where it says "Import from CSV file"; once your file it uploaded it will appear in the interface
Set a name for the lookup and press save

Re: Uploading a csv file into Splunk without adding it onto the physical splunk server

woodcock — Fri, 31 Jul 2015 15:13:08 GMT

This is a common problem when converting an Excel file to CSV. Try saving it as Windows Comma Separated Value (.csv), then you should be able to successfully upload the lookup.

Re: Uploading a csv file into Splunk without adding it onto the physical splunk server

gcarson_splunk — Fri, 21 Oct 2022 22:19:59 GMT

There are also some edge cases where if the csv column names have more than 4094 bytes characters Splunk will throw this error.

The solution in my case was to pre-process the csv and truncate the column names.