topic Reading CSV files from folder in Getting Data In

Reading CSV files from folder

SplunkBaby — Thu, 06 Feb 2014 13:02:29 GMT

Hi
I want to add multiple CSV files to a folder and want spunk to read all the CSV files in that folder.
Ie if i put a CSV file today i want splunk to read that file today and tomorrow also i will put files to that folder.I want splunk to read the file whenever i put CSV files to folder.
How can i achieve this.
Also i want _time field to reflect time when splunk reads the files.
How can i achieve this.

Re: Reading CSV files from folder

Ayn — Thu, 06 Feb 2014 13:46:50 GMT

Docs on getting data in: http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/AboutgettingdataintoSplunk

_time as when Splunk reads the file: set DATETIME_CONFIG = CURRENT in props.conf.
http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps
http://docs.splunk.com/Documentation/Splunk/latest/Data/Configuretimestamprecognition
http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf