topic Re: Indexing a CSV file from a server using REST API and Splunk SDK in Getting Data In

Indexing a CSV file from a server using REST API and Splunk SDK

dileepmandapam — Tue, 19 Sep 2017 17:43:20 GMT

Here is my use-case:
For every hour, I need to download a .csv file from my server using REST API. Using Splunk, I need to index these .csv files

My Approach:
Wrote a Splunk modular input app using Splunk SDK to download CSV files onto a user-specified folder on Splunk file system and
then Splunk monitors entire folder/directory.

Could you guys validate this approach?. Also looking for ways to optimize.

Re: Indexing a CSV file from a server using REST API and Splunk SDK

richgalloway — Tue, 19 Sep 2017 17:54:47 GMT

That's a good way to do it. Another way would be to install a universal forwarder on the CSV server and have it send the files to Splunk as they are created.

Re: Indexing a CSV file from a server using REST API and Splunk SDK

dileepmandapam — Tue, 19 Sep 2017 18:02:10 GMT

But downloading on to Splunk server is a good practice ?. Is it possible to write apps on Universal forwarder?

Re: Indexing a CSV file from a server using REST API and Splunk SDK

richgalloway — Tue, 19 Sep 2017 19:08:41 GMT

Best Practice is to use a forwarder.
Universal forwarders don't run apps, but you shouldn't need your MI with a forwarder on the server where the CSVs reside. If you really need the app, consider using a heavy forwarder.