All Apps and Add-ons

Can I post a CSV file to my remote search head?


Is there any way to post my local CSV file into Remote searchhead using REST call CURL user:password ?

0 Karma


As per my understanding, There is no such out of the box functionality to post csv file to remote search head.

Dynamic lookup update from remote Workaround would be use KV Store lookup and REST API to handle it. However you may need a script to handle the csv read and post the data. You have to create the kv-lookup file manually with fields to refer the collection.

Note: you can use "batch_save" to post multiple records but the limitation is 1000 records per POST

You can create, read, update, delete, and manage KV Store data and collections using the Splunk REST API, which you access on the Splunk management port (the default port is 8089).

curl -k -u admin:yourpassword -d name=kvstorecoll https://localhost:8089/servicesNS/nobody/search/storage/collections/config
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/config/kvstorecoll -d '' -d '' -d 'field.address=string' -d 'accelerated_fields.my_accel={"id": 1}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll -H 'Content-Type: application/json' -d '{"name": "Splunk HQ", "id": 123, "address": { "street": "250 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "94107"}}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll/batch_save -H 'Content-Type: application/json' -d '[{"name": "Splunk Sweden"}, {"name": "Splunk Singapore"}]'


Hope this helps you!!!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...