Trying to have a CSV sent every evening probably use a schedule job to update. Using UF to monitor a folder doesnt seem to work, unless someone has been able to do that. Any assistance would be awesome. Cheers!
Hi @mhammett01,
It's not clear why you tagged "Lookup File Editor", the csv file to monitor is on a Universal Forwarder and must be indexed, is it correct?
let me understand:
I can imagine that your UF are sending logs to Splunk Server so there aren't connection problems, you can simply test this using this search on your Splunk Server (if you have a stand-alone server) or on a Search Head (if you have a Distributed search):
index=_internal host=my_host
If you have results, connection is ok, otherwise you have to test the connection.
So you have to create an Add-On that contains a file called inputs.conf.
Have you a Deployment Server?
So deploy the Add-on on the Universal Forwarder manually or using the Deployment Server.
Anyway, in inputs.conf file there's a dedicated stanza like this:
[monitor:///my_path/my_file.csv]
index=my_index
disabled=0
sourcetype=my_sourcetype
If the name contains the date (e.g. my_file_2019-11-12.csv) you can use:
[monitor:///my_path/my_file*.csv]
In this way you have the input processor to take the file (remember that if you manually deploy the Add-On you have to restart Splunk on Universal Forwarder.
Put attention to the rights on the file: the user running splunkd process must be enabled to read the file.
Ciao.
Giuseppe
And.....nevermind......went to setting>lookup>Lookup table files