Files Ingestion

[muku]

I need to configure a certain customer app to ingest files.Those files needs an add-on which will convert them to be read by splunk, they are in ckls format.I have the add-on already and I have configured in deployments app already. How do I connect with the customer App so as it can show on dashboard?

[livehybrid]

Hi @muku 

How does the app convert the file, is it that the app using a monitor:// stanza within the inputs.conf and then applies props/transforms to manipulate the file, or is it done with a modular input?

Ultimately, the app might need to go on a forwarder if the data resides there or is pulled from there, and/or indexers if there are index-time extractions being applied. If there are search-time extractions applied then the app will also need to go on the searchheads.

If you're able to provide more info then we will be able to give more tailored advice.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing