How to automatically upload CSV files to Splunk monthly?

[akawacz]

Hello,

I would like to upload automatically CSV files in monthly manner. Data should be normally indexed and go to specific sourcetypes (not talking here about lookup tables)

What would be the best way to do that ?

I was thinking here about - http://docs.splunk.com/Documentation/Splunk/6.2.1/Data/Extractfieldsfromfileheadersatindextime

Thank you

[woodcock · Accepted solution]

You do not need to use splunk facilites to update CSV files. You can create a monitor stanza in inputs.conf or create a lookup file in transforms.conf and do this one time and after that use any other process (ftp from outside, cron job on the Search Head) to update the file.

[akawacz]

This sounds good.

Will be possible to pick source type ? (becase i have different files to upload)

[woodcock]

Yes, and if this is a one-time upload of stuff, you should look into using the add oneshot command:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorfilesanddirectoriesusingtheCLI

[ChrisG]

You can set things up to monitor a file or directory. You could automate your file update in that location and then Splunk Enterprise would update it. See Monitor files and directories with Splunk Web, also in the Getting Data In manual. Is that the kind of thing you're looking for?