Archive

Does Splunk allow you to validate structure of a file?

Path Finder

Hi,

I need to be able to validate the format of a file. This entails checking if a date column is actually a date column and if the format of the date value is in the correct format.
I'm not concerned with the content of the data, i.e. im not validating the content, rather I'm more focused on the structure of the data.

Does splunk allow this? And if so how would I go about achieving this?

Thanks

0 Karma

Path Finder

No splunk does not do this. However you can write a script outside splunk and use that script to validate the file meets the format you want before moving it to a folder splunk is ingesting. This is the work around i used to get around files with weird or unreadable formats to splunk

0 Karma

Path Finder

Could you recommend me the best platform to do this?

0 Karma

Motivator

Splunk recognizes lots of file formats (https://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Listofpretrainedsourcetypes)

If your file is something unique to your business then I suggest that you make sure that whatever process which creates it does so correctly.

0 Karma

Path Finder

Hi,

I'm focused mainly on writing queries that basically validates whether a file is in the correct format and then outputting those files that fail validation. I'm not focused on the content, rather the structure - Does Splunk enable this?

0 Karma

Motivator

No, it does not. You would have to do that externally.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!