topic Re: messy code from inputted .xlsx files in Getting Data In

messy code from inputted .xlsx files

lllidan — Wed, 22 Aug 2018 09:23:46 GMT

when i try to input some excel files named xx.xlsx , and then i got some messy codes from search result like: "Pk\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00......." . that's unreadable !
how i can correctly input the kind of .xlsx files ? which source / sourcetype / index should i select ? or maybe i should use some plugins ?

Re: messy code from inputted .xlsx files

adonio — Wed, 22 Aug 2018 10:18:58 GMT

hello there,

Excel files are binary files, not text files
convert to csv format (save as csv), index and enjoy the data
see detailed answers here:
https://answers.splunk.com/answers/568971/what-is-the-best-way-to-index-excel-sheet-to-splun-1.html
https://answers.splunk.com/answers/327256/when-indexing-an-excel-file-with-the-xlsx-file-ext.html

hope it helps

Re: messy code from inputted .xlsx files

niketn — Wed, 22 Aug 2018 10:24:30 GMT

@lllidan , you can upload CSV format data not Excel format to Splunk.

However, you can try out Protocol Data Input created by @Damien Dallimore (BaboonBones Ltd.) for binary format data and code your own Event Handler to process and transform data as per your need. http://www.baboonbones.com/blog/get-binary-data-splunk/

Re: messy code from inputted .xlsx files

inventsekar — Wed, 22 Aug 2018 10:27:08 GMT

Excel files are microsoft window's proprietary product and we can not load excel files directly to splunk.

so, first you have to "export / save as" the excel files to a CSV file. then the csv file can be loaded to splunk.

more on this topic...
https://www.splunk.com/blog/2015/01/30/working-with-spreadsheets-in-splunk-excel-csv-files.html