Does a CSV import connector or a XML import connector exist in current Splunk versions?

[lwedekind]

Does a CSV import connector or a XML import connector exist in current Splunk versions?:)

[gcusello]

Hi @lwedekind,

there isn't a predefined connector, because Splunk doesn't use connectors.

But when you have to ingest a csv or a xml file, you have to configure in props.conf an option, called "INDEXED_EXTRACTIONS" and in this way the format is recognized.

INDEXED_EXTRACTIONS = <CSV|TSV|PSV|W3C|JSON|HEC>
* The type of file that Splunk software should expect for a given source
  type, and the extraction and/or parsing method that should be used on the 
  file.
* The following values are valid for 'INDEXED_EXTRACTIONS':
  CSV  - Comma separated value format
  TSV  - Tab-separated value format
  PSV  - pipe ("|")-separated value format
  W3C  - World Wide Web Consortium (W3C) Extended Log File Format
  JSON - JavaScript Object Notation format
  HEC  - Interpret file as a stream of JSON events in the same format as the 
         HTTP Event Collector (HEC) input.
* These settings change the defaults for other settings in this subsection
  to appropriate values, specifically for these formats.
* The HEC format lets events overide many details on a per-event basis, such
  as the destination index. Use this value to read data which you know to be
  well-formatted and safe to index with little or no processing, such as
  data generated by locally written tools.
* When 'INDEXED_EXTRACTIONS = JSON' for a particular source type, do not also 
  set 'KV_MODE = json' for that source type. This causes the Splunk software to 
  extract the JSON fields twice: once at index time, and again at search time.
* Default: not set

You can find more infos at https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf

Ciao.

Giuseppe