Getting Data In

How to configure Splunk to read a csv file from a universal forwarder?

avni26
Explorer

Hi,
I have one csv file at location /apps/data_splunk/.csv
And this CSV file has data like below
JAN-18 | 31-JAN-2018 | -1 | 1 | 31-JAN-18 | 01-FEB-18 | 727
JAN-18 | 01-FEB-2018 | 1 | 1 | 01-FEB-18 | 02-FEB-18 | 751
JAN-18 | 02-FEB-2018 | 2 | 1 | 02-FEB-18 | 02-FEB-18 | 342
JAN-18 | 06-FEB-2018 | 4 | 1 | 06-FEB-18 | 06-FEB-18 | 323

I want to forward this data to my splunk.
Here is what I have done, but it's not working. I have these setup on the Splunk UF server.
Inputs.conf
[monitor://data_splunk/.csv]
disabled = false
index = _idx2
sourcetype = mycsvfileData

Props.conf
[mycsvfileData]
INDEXED_EXTRACTIONS = csv
SHOULD_LINEMERGE = false
NO_BINARY_CHECK = true
KV_MODE = none
category = Structured
FIELD_DELIMITER = |

Please let me know, what I am doing wrong. Please suggest the better way.
Thanks in advance.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate on "it's not working". What results are you getting compared to what you expect?
The monitor line does not match the file name you say you want to read.

---
If this reply helps you, Karma would be appreciated.

avni26
Explorer

Hi @richgalloway. Not working means, no data is getting reflected to splunk(mycsvfileData sourcetype is not getting reflected in splunk)
ohh , missed it here in question deatil. Monitor line is "[monitor:///apps/data_splunk/.csv]".

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Check the permissions on the file to verify splunk has read access.
Run splunk list monitor on the UF and verify the file is listed.
Check splunkd.log on the UF for errors related to the file.
Verify you have data in index=_internal from the UF.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...