How do I index .csv files from a C drive?

[ldwyer]

I have downloaded a lot of historical .csv files from my Palo Alto for historical reporting. Problem is I dont know how to get that data into SPlunk.

As you can tell I am new to Splunk so any help would be awesome!

thank you

[chanfoli]

Generally you have a few ways to approach this.

1. You can get the logs onto your splunk instance's filesystem and index them either through the command line or through splunkweb. I Recommend the latter so that you can tweak timestamp recognition, timezone, and event separation if required.
2. You can install a unversal forwarder on the system where you have the logs sitting now. If this is a one-shot/test drive or you have a set of logs for a particular project or requirement this is probably more effort than #1 and does not offer a lot more benefits to this situation.
3. You can point your devices at a splunk instance directly using your device's syslog functionality and splunk's network (TCP or UDP) inputs. This is a more long-term solution for the case of network devices.

Ii recommend that you read this guide or at least skim it to get a feel for your options:

http://docs.splunk.com/Documentation/Splunk/latest/Data/WhatSplunkcanmonitor