topic Re: How to do a one time file upload through conf files? in Getting Data In

How to do a one time file upload through conf files?

deva1995 — Mon, 09 Apr 2018 13:05:32 GMT

I want to upload a log file from my computer, through conf files. There will be no monitoring just uploading file only for once. So, which conf file i need to add and what stanzas i need to put in those files?

Re: How to do a one time file upload through conf files?

p_gurav — Mon, 09 Apr 2018 13:26:11 GMT

Is it distributed environment or single instance?

Re: How to do a one time file upload through conf files?

adonio — Mon, 09 Apr 2018 14:00:36 GMT

hello there, for one time upload,
run the command splunk add oneshot
see full description here:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/MonitorfilesanddirectoriesusingtheCLI
if the data is smaller than 500MB, you can drag and drop in the "add data" page

hope it helps

Re: How to do a one time file upload through conf files?

somesoni2 — Mon, 09 Apr 2018 16:36:06 GMT

What's your use-case? Any specific reason for just one time upload?

Re: How to do a one time file upload through conf files?

deva1995 — Wed, 11 Apr 2018 13:11:48 GMT

single instance.

Re: How to do a one time file upload through conf files?

p_gurav — Wed, 11 Apr 2018 13:17:36 GMT

Then you should try one shot command suggested by @adonio.

Re: How to do a one time file upload through conf files?

deva1995 — Wed, 11 Apr 2018 13:47:27 GMT

I want to mask some information in the data I have in my pc. So, i wanted to edit transforms.conf, and upload the data through conf files so that data masking can take place at the indexing time.

Re: How to do a one time file upload through conf files?

deva1995 — Wed, 11 Apr 2018 13:47:56 GMT

this is uploading through CLI, i want to upload the data through conf files.

Re: How to do a one time file upload through conf files?

adonio — Wed, 11 Apr 2018 13:58:55 GMT

you can create the props and transforms on your indexer and when using oneshot, specify the sourcetype.
that will apply your rules of masking to your data

Re: How to do a one time file upload through conf files?

adonio — Wed, 11 Apr 2018 13:59:39 GMT

you can create the props and transforms on your indexer and when using oneshot, specify the sourcetype.
that will apply your rules of masking to your data
you can not do one shot through conf files. you can setup the monitor stanza one time and than disable / comment it out