topic Challenge with splunk forwarder and csv file in Getting Data In

Challenge with splunk forwarder and csv file

eholz1 — Tue, 19 Dec 2023 19:37:09 GMT

Hello,

I need some help. Icreate a csv file on remote server from a mysql quert.

I forward the csv file from the remote server to splunk.

I can read the data. The csv file is over written each day, it have have only 1 line of

data, or multiple lines of data - it is a list of device that have gon down. If no devices

are down, the the file only has the hearder, and data that says: :No Devices Down:" I only want to see data from the file on the day the file is writtern. The challenge I have is to read only the data in the file for that day. The issue is that splunk indexes the data, so splunk retains the data over time, like I want only 1 day info from the file, but splunk has all the data indexed

How can I return only the data for the day, not for all data in splunk indes?

thanks,

EWHolz

Re: Challenge with splunk forwarder and csv file

richgalloway — Wed, 20 Dec 2023 13:51:31 GMT

There are two things you can do.

1) Change the retention period of the indexed data to one day. If necessary, create a new index dedicated to the CSV data.

2) When searching the CSV data, fetch only the most recent day.

index=foo earliest=-24h

Re: Challenge with splunk forwarder and csv file

eholz1 — Wed, 20 Dec 2023 15:41:23 GMT

Hello Members and richgallowy,

Thanks for the tip. It has been a while since I have needed to apply my

limited "Splunk" skills, I appreciate this suggestion, and will try it out;.

Regards,

EWHolz