topic Re: Not able to read CSV from Universal forwarder in Getting Data In

Not able to read CSV from Universal forwarder

shugup2923 — Fri, 10 Jan 2020 09:35:22 GMT

I am trying to read csv from one of my universal forwareder, below is my inputs file

[monitor://D:\DUMP\Updated_Dump*.CSV]
sourcetype=csv
disabled=false
index=xyz
crcSalt=

After checking splunkd log getting below events
INFO TailingProcessor - Adding watch on path: D:\DUMP
INFO TailingProcessor - Parsing configuration stanza: monitor://D:\DUMP\Updated_Dump*.CSV

Please let me know how this can be resolved.

Re: Not able to read CSV from Universal forwarder

skalliger — Fri, 10 Jan 2020 09:51:33 GMT

Those are informational messages, I don't see an error. Also, don't set a crcSalt if you don't need any.
The file is not getting ingested? Any WARN or ERROR messages from TailingProcessor in your log?

Skalli

Re: Not able to read CSV from Universal forwarder

shugup2923 — Fri, 10 Jan 2020 10:03:26 GMT

crcSalt= is there, pasting error .
file is not getting ingested, can't see my data in search head, anyway to troubleshoot ?

Re: Not able to read CSV from Universal forwarder

koshyk — Fri, 10 Jan 2020 10:59:05 GMT

as per logs, it seems it is reading the log file.
what's the search you using to search the data? Have a search across all your splunk for some keyword from CSV. It might have come up as another sourcetype or different index

index=* sourcetype=* <somekeyword_from_csv_file> earliest=-1000d latest=+100d | stats count by sourcetype,index

run btool on sourcetype csv for props.conf & transforms.conf to check if it is getting overridden somewhere.

Re: Not able to read CSV from Universal forwarder

shugup2923 — Mon, 13 Jan 2020 07:47:35 GMT

I am using basic search - index=xyz sourcetype=csv