Getting Data In

How to automatically upload CSV files to Splunk monthly?

akawacz
Path Finder

Hello,

I would like to upload automatically CSV files in monthly manner. Data should be normally indexed and go to specific sourcetypes (not talking here about lookup tables)

What would be the best way to do that ?

I was thinking here about - http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Extractfieldsfromfileheadersatindextime

Thank you

0 Karma
1 Solution

woodcock
Esteemed Legend

You do not need to use splunk facilites to update CSV files. You can create a monitor stanza in inputs.conf or create a lookup file in transforms.conf and do this one time and after that use any other process (ftp from outside, cron job on the Search Head) to update the file.

View solution in original post

woodcock
Esteemed Legend

You do not need to use splunk facilites to update CSV files. You can create a monitor stanza in inputs.conf or create a lookup file in transforms.conf and do this one time and after that use any other process (ftp from outside, cron job on the Search Head) to update the file.

akawacz
Path Finder

This sounds good.

Will be possible to pick source type ? (becase i have different files to upload)

0 Karma

woodcock
Esteemed Legend

Yes, and if this is a one-time upload of stuff, you should look into using the add oneshot command:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorfilesanddirectoriesusingtheCLI

0 Karma

ChrisG
Splunk Employee
Splunk Employee

You can set things up to monitor a file or directory. You could automate your file update in that location and then Splunk Enterprise would update it. See Monitor files and directories with Splunk Web, also in the Getting Data In manual. Is that the kind of thing you're looking for?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...