https://community.splunk.com/t5/Getting-Data-In/Sending-Data-from-Universal-forwarder-to-splunk/m-p/487954#M83524 <P>This can be accomplished with a batch upload to Splunk. <STRONG>Note:</STRONG> this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza. </P> <P>The following configurations are for the Universal Forwarder:</P> <PRE><CODE># inputs.conf [batch:///var/log/mycsvfiles] index = [YOUR INDEX] sourcetype = [YOUR SOURCETYPE] move_policy = sinkhole whitelist = .*\.csv # props.conf [source::...csv] TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV] INDEXED_EXTRACTIONS = CSV </CODE></PRE> Tue, 28 Apr 2020 16:11:19 GMT zacharychristen 2020-04-28T16:11:19Z https://community.splunk.com/t5/Getting-Data-In/Sending-Data-from-Universal-forwarder-to-splunk/m-p/487953#M83523 <P>Hi Splunkers,</P> <P>We have multiple csv files so we need to send data from Universal forwarder to splunk. We tried so many ways we didn't get proper results.</P> <P>Please provide proper stazas for below data.</P> <P>I have attached csv data below. </P> <P>"User","Device type","Device model","UDID","Mac Address","Company Name","OS Version","Agent Version","Latest Config","Policy Name","Last Seen","Registration State","Owner","Hostname","Manufacturer","Config Download Count","Registration TimeStamp","Config Download TimeStamp","Keep Alive Timestamp","Device Hardware Fingerprint","Tunnel Version"<BR /> "<A href="mailto:00000000@example.com">00000000@example.com</A>","IO","Ap dummydevice7,2","958-5F-4-9D-8D999F","00:00:00:00","cbt","Version 11.2.6 (Build 15D100)","1.1.0 (156893) ","No","Unknown","2018-05-14 11:12:19 GMT","Outdated","","","App","1","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","2018-05-14 11:12:19 GMT","95-5F-4D-9D-BB",<BR /> "<A href="mailto:00000000@example.com">00000000@example.com</A>","OS","A dummydevice10,3","4D3E8-49-4CB5-93-3FF467910CEC","00:00:00:00:00:00","cbt","Version 12.0 (Build 16A5365b)","1.2 (165787) ","No","Unknown","2018-08-30 15:41:57 GMT","Outdated","","","A","1","2018-08-30 15:25:34 GMT",,"2018-08-30 15:41:57 GMT","4D-EF-4C-93-3F",</P> Tue, 28 Apr 2020 06:57:30 GMT https://community.splunk.com/t5/Getting-Data-In/Sending-Data-from-Universal-forwarder-to-splunk/m-p/487953#M83523 ajayabburi508 2020-04-28T06:57:30Z https://community.splunk.com/t5/Getting-Data-In/Sending-Data-from-Universal-forwarder-to-splunk/m-p/487954#M83524 <P>This can be accomplished with a batch upload to Splunk. <STRONG>Note:</STRONG> this deletes the file upon indexing. If you have a script that copies the csv file to the batch upload directory, then this should work for what you need. If not, use the monitor stanza. </P> <P>The following configurations are for the Universal Forwarder:</P> <PRE><CODE># inputs.conf [batch:///var/log/mycsvfiles] index = [YOUR INDEX] sourcetype = [YOUR SOURCETYPE] move_policy = sinkhole whitelist = .*\.csv # props.conf [source::...csv] TIMESTAMP_FIELDS = [TIMESTAMP FIELD IN CSV] INDEXED_EXTRACTIONS = CSV </CODE></PRE> Tue, 28 Apr 2020 16:11:19 GMT https://community.splunk.com/t5/Getting-Data-In/Sending-Data-from-Universal-forwarder-to-splunk/m-p/487954#M83524 zacharychristen 2020-04-28T16:11:19Z