https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348129#M63920 <P>The best thing to do would be to set up a file monitor(then you wouldnt have to do it manually everyday as it will continuously monitor wherever you dump that CSV file)..Should be pretty straightforward as your data will be in CSV format so fields can be split based on that as a delimiter. Please see below guide for setting up a file monitor:</P> <P>Via SplunkWeb:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/MonitorfilesanddirectorieswithSplunkWeb">http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/MonitorfilesanddirectorieswithSplunkWeb</A></P> <P>Via conf file:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitorfilesanddirectorieswithinputs.conf">http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitorfilesanddirectorieswithinputs.conf</A></P> Mon, 25 Sep 2017 15:31:42 GMT mwdbhyat 2017-09-25T15:31:42Z https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348128#M63919 <P>So, I have been tasked with monitoring our EPO server, which is managed by a managed service. Long story short, the only way we can get data from the EPO server is via a once a day CSV file dump. I'm sorry, but I'm still learning Splunk. What app would be the best way to ingest the data? I know I will have to manually upload the data.</P> Mon, 25 Sep 2017 15:25:54 GMT https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348128#M63919 rapture005 2017-09-25T15:25:54Z https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348129#M63920 <P>The best thing to do would be to set up a file monitor(then you wouldnt have to do it manually everyday as it will continuously monitor wherever you dump that CSV file)..Should be pretty straightforward as your data will be in CSV format so fields can be split based on that as a delimiter. Please see below guide for setting up a file monitor:</P> <P>Via SplunkWeb:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/MonitorfilesanddirectorieswithSplunkWeb">http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/MonitorfilesanddirectorieswithSplunkWeb</A></P> <P>Via conf file:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitorfilesanddirectorieswithinputs.conf">http://docs.splunk.com/Documentation/Splunk/6.6.3/Data/Monitorfilesanddirectorieswithinputs.conf</A></P> Mon, 25 Sep 2017 15:31:42 GMT https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348129#M63920 mwdbhyat 2017-09-25T15:31:42Z https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348130#M63921 <P>Thanks for the quick response. This looks to be what I need! Thank you very much!</P> Mon, 25 Sep 2017 15:36:04 GMT https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348130#M63921 rapture005 2017-09-25T15:36:04Z https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348131#M63922 <P>Hey @rapture005, please remember to mark comments as comments and answers as answers. I moved your preview "answer" to a comment. Thank you!</P> Mon, 25 Sep 2017 19:19:22 GMT https://community.splunk.com/t5/Getting-Data-In/Manually-Importing-McAfee-EPO-Data/m-p/348131#M63922 lfedak_splunk 2017-09-25T19:19:22Z