topic Re: Help to onboard automatically a csv in splunk in Splunk Search https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617279#M214518 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/102660">@jip31</a>,</P><P>yes it's correct.</P><P>Only one additional step: if you have a csv file, you have to also add props.conf (containing INDEXED_EXTRACTION = csv ) to the Forwarder.</P><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Sun, 16 Oct 2022 16:09:26 GMT gcusello 2022-10-16T16:09:26Z Help to onboard automatically a csv in splunk https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617278#M214517 <P>Hello</P><P><FONT face="inherit">I try to summarize the </FONT>different<FONT face="inherit">&nbsp;steps to onboard automatically a csv file in Splunk</FONT></P><P><SPAN>1) On the forwarder:</SPAN></P><P><SPAN>- I need an inputs.conf to tell the forwarder what data to send. (And eventually props.conf)</SPAN></P><P><SPAN><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf" target="_blank" rel="noopener">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf</A></SPAN></P><P><SPAN>- I also need an outputs.conf to tell the forwarder where to send the data.&nbsp;</SPAN></P><DIV class=""><DIV class=""><DIV><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><DIV class=""><P><STRONG>inputs.conf</STRONG></P><PRE>[monitor://C:\Program Files\SysCheck\Logs\*.txt]</PRE><P><STRONG>outputs.conf</STRONG></P><PRE>[tcpout:anyName] server=indexer.myco.com:9997</PRE><P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf" target="_blank" rel="noopener">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf</A></P><P>&nbsp;</P><P>2) On the indexer</P><P><SPAN>I need to configure the receiving port on </SPAN><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver" target="_blank" rel="nofollow noopener noreferrer">http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Enableareceiver</A></P><P>Is it correct?</P><P>Thanks</P></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV> Sun, 16 Oct 2022 15:57:29 GMT https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617278#M214517 jip31 2022-10-16T15:57:29Z Re: Help to onboard automatically a csv in splunk https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617279#M214518 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/102660">@jip31</a>,</P><P>yes it's correct.</P><P>Only one additional step: if you have a csv file, you have to also add props.conf (containing INDEXED_EXTRACTION = csv ) to the Forwarder.</P><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Sun, 16 Oct 2022 16:09:26 GMT https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617279#M214518 gcusello 2022-10-16T16:09:26Z Re: Help to onboard automatically a csv in splunk https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617304#M214533 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/102660">@jip31</a>,</P><P>good for you, see next time!</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Mon, 17 Oct 2022 07:16:46 GMT https://community.splunk.com/t5/Splunk-Search/Help-to-onboard-automatically-a-csv-in-splunk/m-p/617304#M214533 gcusello 2022-10-17T07:16:46Z