Does Splunk allow you to validate structure of a file?

[mahbs]

Hi,

I need to be able to validate the format of a file. This entails checking if a date column is actually a date column and if the format of the date value is in the correct format.
I'm not concerned with the content of the data, i.e. im not validating the content, rather I'm more focused on the structure of the data.

Does splunk allow this? And if so how would I go about achieving this?

Thanks

[afamoyib]

No splunk does not do this. However you can write a script outside splunk and use that script to validate the file meets the format you want before moving it to a folder splunk is ingesting. This is the work around i used to get around files with weird or unreadable formats to splunk

[mahbs]

Could you recommend me the best platform to do this?

[lycollicott]

Splunk recognizes lots of file formats (https://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Listofpretrainedsourcetypes)

If your file is something unique to your business then I suggest that you make sure that whatever process which creates it does so correctly.

[mahbs]

Hi,

I'm focused mainly on writing queries that basically validates whether a file is in the correct format and then outputting those files that fail validation. I'm not focused on the content, rather the structure - Does Splunk enable this?

[lycollicott]

No, it does not. You would have to do that externally.