Can I upload raw SAR text files to Splunk?

[suzyd]

Hi,

I'm trying to upload raw SAR text files to Splunk, is it possible?

Is there an add-on or other method to do this directly into Splunk? Or is the only way to use sysstat, then the add-on for Linux (on the forwarder) and the GUI for SysStat?

Thanks.

[PavelP]

Hello @suzyd,

sar files are binary and cannot be read by Splunk as such. You need to use sar or sadf command to convert them into text.

You can convert sar raw files on the source system or push them on the universal or heavy forwarder via rsync/scp/etc. and process there.

I've tried various methods but ended with real time push using scripting input: https://splunkbase.splunk.com/app/1803/#/details
You can modify this app for your need as required.