https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22046#M177400 <P>Sorry, accepted:) And thanks for all the comments!</P> Thu, 07 Feb 2013 20:50:12 GMT kestasm 2013-02-07T20:50:12Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22038#M177392 <P>Hi,</P> <P>maybe somebody could advice how can I use quite big csv file (which gets updated frequently) with one column of entries (as an example IP addresses) for generating an alerts or reports to be reviewed daily/weekly? Is there a limit on entries in csv file column which could be handled by SPLUNK?</P> Wed, 06 Feb 2013 16:30:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22038#M177392 kestasm 2013-02-06T16:30:14Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22039#M177393 <P>it sounds as though you might want to configure a lookup in Splunk that uses the csv file. this lets you look up values in a csv file as part of a Splunk search. there is information about doing this here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/Addfieldsfromexternaldatasources">http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/Addfieldsfromexternaldatasources</A></P> <P>if the csv file gets updated by values being added to the end, another option is for you to just index the csv file using a Splunk monitor, which will keep checking the file for any new data:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Monitorfilesanddirectories">http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Monitorfilesanddirectories</A></P> <P>if you provide a bit more information about the file and how it is updated, i could maybe be more helpful...</P> Wed, 06 Feb 2013 23:13:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22039#M177393 piebob 2013-02-06T23:13:23Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22040#M177394 <P>Hi, thanks for this. Well we get this csv updated file by email, so as I imagine we could update indexed existing file entries ourselfs, right?</P> <P>We already have some lookups configured to use csv files, but those are small files needed for one time search only. What we need with this file (it is quite big 37k entries (IP addresses) at the moment, and gets updated every week) is to make continuous alerting on IPs whenever there is a match, and to send alert reports on weekly basis to email box. So if you could think of some way to do this I would be greatly appreciated.</P> Wed, 06 Feb 2013 23:55:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22040#M177394 kestasm 2013-02-06T23:55:54Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22041#M177395 <P>this sounds like a good use case for a lookup, you would just update the lookup file once a week. it's just one column of IP addresses? that shouldn't be too big for Splunk. configure the lookup, and then set up an alert based on the IPs you're interested in.</P> Thu, 07 Feb 2013 00:30:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22041#M177395 piebob 2013-02-07T00:30:56Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22042#M177396 <P>is there any limitation in SPLUNK of how much entries in csv file it can handle? I mean isn't it too much of 37k entries?</P> Thu, 07 Feb 2013 16:49:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22042#M177396 kestasm 2013-02-07T16:49:57Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22043#M177397 <P>no, 37k entries is not too much for Splunk to handle.</P> Thu, 07 Feb 2013 16:53:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22043#M177397 piebob 2013-02-07T16:53:06Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22044#M177398 <P>Great, thanks, is there a way to configure alert to email reports/summaries of all alerts once a week, lets say? Is there an expiration of created alert by default? Thanks!</P> Thu, 07 Feb 2013 19:47:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22044#M177398 kestasm 2013-02-07T19:47:00Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22045#M177399 <P>you should check out the documentation, there is an entire manual about alerting: <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Aboutalerts">http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Aboutalerts</A></P> <P>and please accept my answer to this question.</P> Thu, 07 Feb 2013 20:05:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22045#M177399 piebob 2013-02-07T20:05:41Z https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22046#M177400 <P>Sorry, accepted:) And thanks for all the comments!</P> Thu, 07 Feb 2013 20:50:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-under-csv-file/m-p/22046#M177400 kestasm 2013-02-07T20:50:12Z