All Apps and Add-ons

Where are the imported CSV located on linux?

New Member

Trying to have a CSV sent every evening probably use a schedule job to update. Using UF to monitor a folder doesnt seem to work, unless someone has been able to do that. Any assistance would be awesome. Cheers!

Tags (1)
0 Karma


Hi @mhammett01,
It's not clear why you tagged "Lookup File Editor", the csv file to monitor is on a Universal Forwarder and must be indexed, is it correct?

let me understand:

  • you have a Universal Forwarder installed on a Linux Server,
  • on this server you have a csv to monitor,
  • you want to monitor this file that's updated every day.

I can imagine that your UF are sending logs to Splunk Server so there aren't connection problems, you can simply test this using this search on your Splunk Server (if you have a stand-alone server) or on a Search Head (if you have a Distributed search):

index=_internal host=my_host

If you have results, connection is ok, otherwise you have to test the connection.

So you have to create an Add-On that contains a file called inputs.conf.
Have you a Deployment Server?
So deploy the Add-on on the Universal Forwarder manually or using the Deployment Server.

Anyway, in inputs.conf file there's a dedicated stanza like this:


If the name contains the date (e.g. my_file_2019-11-12.csv) you can use:


In this way you have the input processor to take the file (remember that if you manually deploy the Add-On you have to restart Splunk on Universal Forwarder.

Put attention to the rights on the file: the user running splunkd process must be enabled to read the file.


0 Karma

New Member

And.....nevermind......went to setting>lookup>Lookup table files

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST