topic Re: Ingesting Word document in Getting Data In

Ingesting Word document

timrich66 — Wed, 26 Aug 2020 12:09:28 GMT

Hello all,

My latest challenge is to ingest a Word doc into our environment. According to everything I have read so far, this should be straight forward as Splunk can ingest 'any' file. At this point I should point out that I am not concerned about the contents of the file (as this all needs to be obfuscated). I only need to ingest the file to get its name. I am not concerned about whether or not Splunk can read the 'Word' type formatting.

The file is created daily with the format - "My Word Doc ddmmyyyy hh mm.doc"

I am only interested in the "ddmmyyyy hh mm" part to ensure that it has been created today.

I cannot get the doc file to ingest at all. Not even in an unformatted state. If I save the file as a ".txt" file, then it is ingested. Unfortunately, the 'save as' option is not an option in production.

I have tried using 'whitelist=' option without any success.

Can anyone suggest a solution? Is there something in my installation that is stopping Word docs from being ingested? Has anyone else had a similar experience?

Thanks

Re: Ingesting Word document

richgalloway — Wed, 26 Aug 2020 12:37:44 GMT

Your initial assumption is faulty. Splunk cannot ingest *any* file. It can, however, ingest any *text* file. Word files are not text.
Consider writing a python script to test for the presence of the file and making it a scripted input.

Re: Ingesting Word document

timrich66 — Wed, 02 Sep 2020 10:03:52 GMT

Thanks for the reply. I am, however, still confused. There are a number of Questions about how to ingest with the correct format - eg https://community.splunk.com/t5/Archive/How-to-ingest-doc-format-file-into-splunk-with-correct-format/td-p/488474

As I have stated, I am not concerned with the format within the doc, only the filename is of importance.

Re: Ingesting Word document

richgalloway — Wed, 02 Sep 2020 12:46:42 GMT

Ingesting an entire Word package, possibly several MB, just to find out if a file exists seems wasteful to me.

As I suggested earlier, consider a script to test for the presence of the file and report to Splunk.

Re: Ingesting Word document

timrich66 — Wed, 02 Sep 2020 15:23:26 GMT

The file is tiny. I will look at what other options are available. Thanks