Dashboards & Visualizations

Is it possible - file upload input in Simple XML?

crt89
Communicator

Good day Splunkers,

I was thinking what if I can use a file upload and use the file contents as field filters for a search (csv format or txt file). Is this possible on the current Splunk simple xml or do I need to use sdk?

Thanks,
-crt

0 Karma

dimoobraznii
Path Finder

Hi @crt89,

Yes, it is possible and quite easy.

You have several options.

1) You can use it during input step, in preview mode go to advance tab and add additional parameter
KV_MODE=XML
Here http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract... you can find additional information.

Go futher, if you are working with XML, you should define TIMESTAMP and BEGIN/END of event. In this case you need additional parameters:
BREAK_ONLY_BEFORE =
MAX_TIMESTAMP_LOOKAHEAD =
NO_BINARY_CHECK =
TIME_PREFIX =

Here is detail information: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configurepositionaltimestampextraction

2) You can extract fields in search using search command XMLKV

Here is detail information: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/xmlkv

3) You can extract fields using regex and here we have to option:
-write regex manually
-use Interactive Field Extraction
Here is detail information: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/ExtractfieldsinteractivelywithIFX and http://answers.splunk.com/answers/96430/interactive-field-extraction-ifx-regex.html

0 Karma

crt89
Communicator

Hi @dimoobraznii

I think you get the idea wrong, I am not going to index data, I was thinking I can use the contents of a file, and use it in my search.

Example:
File.csv - has list of 100 IPs

Here's what I am thinking, in a dashboard there is this button for upload (like the ones you see when uploading pics from sites like fb). User will click on the upload button and upload the file.csv which has the list of 100 IPs. Once the user click the search on the dashboard, the search string behind would get all the 100 IPs listed on the file.csv that has been uploaded and use it on a search string.

Is it possible?

Sorry for the misleading subject title.

Thanks,
-crt

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...