topic Re: How to automatically upload CSV files to Splunk monthly? in Getting Data In

How to automatically upload CSV files to Splunk monthly?

akawacz — Thu, 22 Oct 2015 08:56:41 GMT

Hello,

I would like to upload automatically CSV files in monthly manner. Data should be normally indexed and go to specific sourcetypes (not talking here about lookup tables)

What would be the best way to do that ?

I was thinking here about - http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Extractfieldsfromfileheadersatindextime

Thank you

Re: How to automatically upload CSV files to Splunk monthly?

ChrisG — Thu, 22 Oct 2015 09:20:12 GMT

You can set things up to monitor a file or directory. You could automate your file update in that location and then Splunk Enterprise would update it. See Monitor files and directories with Splunk Web, also in the Getting Data In manual. Is that the kind of thing you're looking for?

Re: How to automatically upload CSV files to Splunk monthly?

woodcock — Thu, 22 Oct 2015 13:14:53 GMT

You do not need to use splunk facilites to update CSV files. You can create a monitor stanza in inputs.conf or create a lookup file in transforms.conf and do this one time and after that use any other process (ftp from outside, cron job on the Search Head) to update the file.

Re: How to automatically upload CSV files to Splunk monthly?

akawacz — Thu, 22 Oct 2015 15:22:53 GMT

This sounds good.

Will be possible to pick source type ? (becase i have different files to upload)

Re: How to automatically upload CSV files to Splunk monthly?

woodcock — Thu, 22 Oct 2015 16:03:22 GMT

Yes, and if this is a one-time upload of stuff, you should look into using the add oneshot command:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorfilesanddirectoriesusingtheCLI