Is it possible - file upload input in Simple XML?

[crt89]

Good day Splunkers,

I was thinking what if I can use a file upload and use the file contents as field filters for a search (csv format or txt file). Is this possible on the current Splunk simple xml or do I need to use sdk?

Thanks,
-crt

[dimoobraznii]

Hi @crt89,

Yes, it is possible and quite easy.

You have several options.

1) You can use it during input step, in preview mode go to advance tab and add additional parameter
KV_MODE=XML
Here http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract... you can find additional information.

Go futher, if you are working with XML, you should define TIMESTAMP and BEGIN/END of event. In this case you need additional parameters:
BREAK_ONLY_BEFORE =
MAX_TIMESTAMP_LOOKAHEAD =
NO_BINARY_CHECK =
TIME_PREFIX =

Here is detail information: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configurepositionaltimestampextraction

2) You can extract fields in search using search command XMLKV

Here is detail information: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/xmlkv

3) You can extract fields using regex and here we have to option:
-write regex manually
-use Interactive Field Extraction
Here is detail information: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/ExtractfieldsinteractivelywithIFX and http://answers.splunk.com/answers/96430/interactive-field-extraction-ifx-regex.html

[crt89]

Hi @dimoobraznii

I think you get the idea wrong, I am not going to index data, I was thinking I can use the contents of a file, and use it in my search.

Example:
File.csv - has list of 100 IPs

Here's what I am thinking, in a dashboard there is this button for upload (like the ones you see when uploading pics from sites like fb). User will click on the upload button and upload the file.csv which has the list of 100 IPs. Once the user click the search on the dashboard, the search string behind would get all the 100 IPs listed on the file.csv that has been uploaded and use it on a search string.

Is it possible?

Sorry for the misleading subject title.

Thanks,
-crt