topic How to Read a CSV file (with time-stamped data for past 24 hours) and Index the data in Getting Data In

How to Read a CSV file (with time-stamped data for past 24 hours) and Index the data

htkwan — Fri, 21 Jul 2017 16:25:31 GMT

Hello All,
My client's machine generates a daily data log (in csv format). How do one configure splunk to read & index the past 1 day of data. The csv file has the following format.
Header >> Datetime, Tag1, Tag2
Row1 >> 2017-07-01 23:00:00, 23.45, 12.56
Row2 >> 2017-07-01 23:01:00, 33.45, 22.56

Pls. advise. Thanks

Re: How to Read a CSV file (with time-stamped data for past 24 hours) and Index the data

sbbadri — Tue, 29 Sep 2020 15:02:24 GMT

Please see below,

create $SPLUNK_HOME/etc/apps/yourapp/local/inputs.conf

[monitor://$SPLUNK_HOME/input/myfile.csv]
host=myhost
source=mysource
sourcetype=mysourcetype
index=myindex

$SPLUNK_HOME/etc/apps/your app/local/props.conf
[source::mysource]
REPORT-mysource = mysource_csv

$SPLUNK_HOME/etc/apps/yourapp/local/transforms.conf
[mysource_csv]
DELIMS = ","
FIELDS = "field1","field2","field3","field4","field5".....

Go through below link for further details,

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Extractfieldsfromfileheadersatindextime

Re: How to Read a CSV file (with time-stamped data for past 24 hours) and Index the data

htkwan — Sat, 22 Jul 2017 05:04:45 GMT

Thanks very much

Re: How to Read a CSV file (with time-stamped data for past 24 hours) and Index the data

woodcock — Sat, 22 Jul 2017 20:56:19 GMT

If you got it working, do click Accept to close your question.