topic Re: Can I upload raw SAR text files to Splunk? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Can-I-upload-raw-SAR-text-files-to-Splunk/m-p/471414#M81020 <P>Hello @suzyd,</P> <P>sar files are binary and cannot be read by Splunk as such. You need to use sar or sadf command to convert them into text.</P> <P>You can convert sar raw files on the source system or push them on the universal or heavy forwarder via rsync/scp/etc. and process there.</P> <P>I've tried various methods but ended with real time push using scripting input: <A href="https://splunkbase.splunk.com/app/1803/#/details">https://splunkbase.splunk.com/app/1803/#/details</A><BR /> You can modify this app for your need as required.</P> Thu, 04 Jun 2020 11:29:29 GMT PavelP 2020-06-04T11:29:29Z Can I upload raw SAR text files to Splunk? https://community.splunk.com/t5/Getting-Data-In/Can-I-upload-raw-SAR-text-files-to-Splunk/m-p/471413#M81019 <P>Hi,</P> <P>I'm trying to upload raw SAR text files to Splunk, is it possible?</P> <P>Is there an add-on or other method to do this directly into Splunk? Or is the only way to use sysstat, then the add-on for Linux (on the forwarder) and the GUI for SysStat?</P> <P>Thanks.</P> Sat, 06 Jun 2020 23:37:14 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-upload-raw-SAR-text-files-to-Splunk/m-p/471413#M81019 suzyd 2020-06-06T23:37:14Z Re: Can I upload raw SAR text files to Splunk? https://community.splunk.com/t5/Getting-Data-In/Can-I-upload-raw-SAR-text-files-to-Splunk/m-p/471414#M81020 <P>Hello @suzyd,</P> <P>sar files are binary and cannot be read by Splunk as such. You need to use sar or sadf command to convert them into text.</P> <P>You can convert sar raw files on the source system or push them on the universal or heavy forwarder via rsync/scp/etc. and process there.</P> <P>I've tried various methods but ended with real time push using scripting input: <A href="https://splunkbase.splunk.com/app/1803/#/details">https://splunkbase.splunk.com/app/1803/#/details</A><BR /> You can modify this app for your need as required.</P> Thu, 04 Jun 2020 11:29:29 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-upload-raw-SAR-text-files-to-Splunk/m-p/471414#M81020 PavelP 2020-06-04T11:29:29Z