Exporting/Importing a CSV to new Splunk Enterprise instance

Branden — Tue, 19 Nov 2024 17:01:09 GMT

Hello. I cannot find a solution to this one here...

I have logs in one Splunk instance. I've exported them to CSV and want to perform a one-time ingest of that CSV into a new on-prem Splunk Enterprise instance.

I have the CSV and can import it. However, I can't figure out how to preserve each row/event's original 'host', timestamp, and 'sourcetype' entry. When I do the import, it records the 'host' as the Splunk indexer, and the timestamp as the date of the import, which makes sense but is not the desired behavior.

Here is a sample row of the CSV:

_time,host,index,source,sourcetype 2024-11-19T11:36:05.000-0500,host1.example.com,test-index,/var/log/messages,syslog 2024-11-19T11:36:05.000-0500,host2.example.com,test-index,/var/log/messages,syslog

I removed the _raw column, but I can include it if necessary.

How do I import these events while preserving the event time, host, and sourcetype fields? Is this even possible?

I looked around here and can't find anyone with this scenario.

Thank you in advance!

Re: Exporting/Importing a CSV to new Splunk Enterprise instance

marnall — Tue, 19 Nov 2024 20:08:51 GMT

You could make a transforms config which tells Splunk to extract the host field from the log:

# props.conf [yoursourcetype] TRANSFORMS-anynameyouwant = arbitrarytransformname # transforms.conf [arbitrarytransformname] DEST_KEY = MetaData:Host REGEX = ^[^,]*,([^,]+) FORMAT = host::$1

Once this config is applied to your indexing tier, it will set the host based on the second column in your logs.

The default timestamp finder should also find the _time value from your logs in the first column, unless you are setting a sourcetype that bypasses the regular timestamp extraction. You might also try putting the logs to import into a file on the splunk machine using the cli and then making an inputs.conf to index it.

You should be able to set the sourcetype either from the inputs.conf stanza or in the webUI when uploading the logs.

topic Re: Exporting/Importing a CSV to new Splunk Enterprise instance in Other Usage

Exporting/Importing a CSV to new Splunk Enterprise instance

Re: Exporting/Importing a CSV to new Splunk Enterprise instance