Getting Data In

Can I upload raw SAR text files to Splunk?

New Member


I'm trying to upload raw SAR text files to Splunk, is it possible?

Is there an add-on or other method to do this directly into Splunk? Or is the only way to use sysstat, then the add-on for Linux (on the forwarder) and the GUI for SysStat?


Labels (1)
0 Karma


Hello @suzyd,

sar files are binary and cannot be read by Splunk as such. You need to use sar or sadf command to convert them into text.

You can convert sar raw files on the source system or push them on the universal or heavy forwarder via rsync/scp/etc. and process there.

I've tried various methods but ended with real time push using scripting input:
You can modify this app for your need as required.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...