topic How to ingest excel from UF in Getting Data In

How to ingest excel from UF

Dayalss — Mon, 28 Aug 2023 10:52:39 GMT

Hi,

I have a excel file on a linux server at a particular path.

I have created a input file to monitor this file , but Im not receiving any logs.

Can anyone help me how to get that excel daily by creating a input.conf

Re: How to ingest excel from UF

richgalloway — Mon, 28 Aug 2023 14:05:30 GMT

It depends on the type of Excel file. A .xls file is binary and so will not be ingested by Splunk. The UF's splunkd.log file should confirm this.

Newer Excel files are .xlsx, which is XML format. That can be ingested by Splunk, but may be of limited utility if you can't interpret the XML.

There's also .xlsm files, which contain macros, but I'm not sure how they're stored.

Again, the UF should log a message when it's unable to monitor/ingest a file.

Re: How to ingest excel from UF

gcusello — Mon, 28 Aug 2023 15:29:38 GMT

Hi @Dayalss,

I confirm what @richgalloway said: there isn't any tool or Add-On to directly ingest Excel Files, the only way is passing through a csv conversion to perform out of Splunk before ingestistion.

You can do this is a script (e.g. in Python) like the ones described in these pages:

https://www.google.com/search?q=script+to+convert+an+excel+file+in+csv&rlz=1C1VDKB_itIT1048IT1048&oq=script+to+convert+an+excel+file+in+csv&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQABiiBDIHCAIQABiiBDIHCAMQABiiBNIBCTE1ODA3ajFqN6gCALACAA&sourceid=chrome&ie=UTF-8

Ciao.

Giuseppe