Getting Data In

Challenge with splunk forwarder and csv file

eholz1
Contributor

Hello,

I need some help. Icreate a csv file on remote server from a mysql quert.

I forward the csv file from the remote server to splunk.

I can read the data. The csv file is over written each day, it have have only 1 line of

data, or multiple lines of data - it is a list of device that have gon down. If no devices

are down, the the file only has the hearder, and data that says: :No Devices Down:" I  only want to see data from the file on the day the file is writtern. The challenge I have is to read only the data in the file for that day. The issue is that splunk indexes the data, so splunk retains the data over time, like I want only 1 day info from the file, but splunk has all the data indexed

How can I return only the data for the day, not for all data in splunk indes?

thanks,

EWHolz

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are two things you can do.

1) Change the retention period of the indexed data to one day.  If necessary, create a new index dedicated to the CSV data.

2) When searching the CSV data, fetch only the most recent day.

index=foo earliest=-24h
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

There are two things you can do.

1) Change the retention period of the indexed data to one day.  If necessary, create a new index dedicated to the CSV data.

2) When searching the CSV data, fetch only the most recent day.

index=foo earliest=-24h
---
If this reply helps you, Karma would be appreciated.

eholz1
Contributor

Hello Members and richgallowy,

 

Thanks for the tip. It has been a while since I have needed to apply my

limited "Splunk" skills, I appreciate this suggestion, and will try it out;.

 

Regards,

EWHolz

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...