Hi @lwedekind,
there isn't a predefined connector, because Splunk doesn't use connectors.
But when you have to ingest a csv or a xml file, you have to configure in props.conf an option, called "INDEXED_EXTRACTIONS" and in this way the format is recognized.
INDEXED_EXTRACTIONS = <CSV|TSV|PSV|W3C|JSON|HEC>
* The type of file that Splunk software should expect for a given source
type, and the extraction and/or parsing method that should be used on the
file.
* The following values are valid for 'INDEXED_EXTRACTIONS':
CSV - Comma separated value format
TSV - Tab-separated value format
PSV - pipe ("|")-separated value format
W3C - World Wide Web Consortium (W3C) Extended Log File Format
JSON - JavaScript Object Notation format
HEC - Interpret file as a stream of JSON events in the same format as the
HTTP Event Collector (HEC) input.
* These settings change the defaults for other settings in this subsection
to appropriate values, specifically for these formats.
* The HEC format lets events overide many details on a per-event basis, such
as the destination index. Use this value to read data which you know to be
well-formatted and safe to index with little or no processing, such as
data generated by locally written tools.
* When 'INDEXED_EXTRACTIONS = JSON' for a particular source type, do not also
set 'KV_MODE = json' for that source type. This causes the Splunk software to
extract the JSON fields twice: once at index time, and again at search time.
* Default: not set
You can find more infos at https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf
Ciao.
Giuseppe
