Getting Data In

How to Read a CSV file (with time-stamped data for past 24 hours) and Index the data

htkwan
Path Finder

Hello All,
My client's machine generates a daily data log (in csv format). How do one configure splunk to read & index the past 1 day of data. The csv file has the following format.
Header >> Datetime, Tag1, Tag2
Row1 >> 2017-07-01 23:00:00, 23.45, 12.56
Row2 >> 2017-07-01 23:01:00, 33.45, 22.56

Pls. advise. Thanks

Tags (2)

sbbadri
Motivator

Please see below,

create $SPLUNK_HOME/etc/apps/yourapp/local/inputs.conf

[monitor://$SPLUNK_HOME/input/myfile.csv]
host=myhost
source=mysource
sourcetype=mysourcetype
index=myindex

$SPLUNK_HOME/etc/apps/your app/local/props.conf
[source::mysource]
REPORT-mysource = mysource_csv

$SPLUNK_HOME/etc/apps/yourapp/local/transforms.conf
[mysource_csv]
DELIMS = ","
FIELDS = "field1","field2","field3","field4","field5".....

Go through below link for further details,

http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Extractfieldsfromfileheadersatindextime

htkwan
Path Finder

Thanks very much

0 Karma

woodcock
Esteemed Legend

If you got it working, do click Accept to close your question.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...